ESET Finds Windows SprySOCKS Variants in Attacks on Government Organizations
Summary
ESET found Windows SprySOCKS variants used against government organizations in four countries and attributed the activity with high confidence to Earth Lusca. The variants add kernel-level stealth and TCP traffic diversion; a possible UEFI bootkit link remains unsubst
Key points
- ESET says the Windows variants were used in attacks on government organizations in Taiwan, Thailand, Pakistan, and Honduras between 2023 and 2024.
- ESET attributes the activity with high confidence to Earth Lusca, also tracked as FishMonger, Aquatic Panda, Red Dev 10, and TAG-22.
- The variants, WIN_DRV and WIN_PLUS, support more than 30 command-and-control commands and can collect system information, manage files and processes, and log keystrokes and clipboard content.
- WIN_DRV loads the RawWNPF driver in memory to hide processes, network connections, files, and persistence-related Registry entries.
- WIN_DRV and WIN_PLUS use different persistence methods, including scheduled tasks and IFEO settings, and registration as a Windows Print Processor, respectively.
- WIN_DRV can divert specially crafted incoming TCP traffic to communicate with the backdoor without exposing its listening port.
- ESET telemetry suggested a possible UEFI bootkit component exploiting CVE-2023-24932, but the article says there is no strong evidence linking it to BlackLotus.
Article Details
- Attack Vectors
- Windows SprySOCKS variants were used in attacks against government organizations in Taiwan, Thailand, Pakistan, and Honduras between 2023 and 2024.
- WIN_DRV uses kernel drivers for stealth, hiding processes, network connections, files, and persistence-related Registry entries.
- WIN_DRV can redirect specially crafted incoming TCP packets to the backdoor, allowing communication through another port without exposing its listening port.
- WIN_DRV persistence uses scheduled tasks and Image File Execution Options via vds.exe; WIN_PLUS persistence registers the payload as a Windows Print Processor.
- The variants support C2 over TCP, UDP, and WebSocket, SOCKS proxy functionality, file operations, system and process information collection, keystroke logging, and clipboard collection.
- ESET telemetry indicated a possible UEFI bootkit component that might exploit CVE-2023-24932; the article reports no strong evidence linking it to BlackLotus.
- Defensive Notes
- Investigate unexpected scheduled tasks, Image File Execution Options changes involving vds.exe, and unusual Windows Print Processor registrations.
- Review kernel-driver activity and investigate the named components RawWNPF, DriverLoader, and fsdiskbit.sys.
- Monitor for concealed processes, files, network connections, or Registry entries, and for unusual TCP traffic that may be redirected to a backdoor.
- ESET's report is described as containing indicators of compromise that organizations can use to identify and protect against these Windows SprySOCKS variants.
MITRE ATT&CK
T1007 · System Service DiscoveryThe variants can enumerate and manage services.T1014 · RootkitWIN_DRV loads a kernel driver that hides processes, network connections, files, and Registry entries.T1053.005 · Scheduled TaskWIN_DRV uses scheduled tasks as a persistence method.T1056.001 · KeyloggingThe SprySOCKS variants can log keystrokes.T1057 · Process DiscoveryThe variants can enumerate processes.T1082 · System Information DiscoveryThe variants can collect system information.T1090 · ProxyThe variants support SOCKS proxy functionality.T1105 · Ingress Tool TransferThe variants support uploading and downloading files.T1115 · Clipboard DataThe SprySOCKS variants can collect clipboard content.T1546.012 · Image File Execution Options InjectionWIN_DRV uses Image File Execution Options via vds.exe for persistence.T1547.010 · Port MonitorsWIN_PLUS persists by registering the payload as a Windows Print Processor.
CVE
Threat Actors
Aquatic PandaThe article identifies Aquatic Panda as another name for Earth Lusca, which ESET attributes with high confidence to the reported activity.Earth LuscaESET attributes the activity using Windows SprySOCKS variants against government organizations with high confidence to Earth Lusca.FishMongerESET tracks the group it attributes with high confidence to the activity as FishMonger; the article identifies FishMonger as another name for Earth Lusca.Red Dev 10The article identifies Red Dev 10 as another name for Earth Lusca, which ESET attributes with high confidence to the reported activity.TAG-22The article identifies TAG-22 as another name for Earth Lusca, which ESET attributes with high confidence to the reported activity.
Malware
Vendors
Products
Countries
HondurasESET found Windows variants of the SprySOCKS backdoor used in attacks against government organizations in Taiwan, Thailand, Pakistan, and Honduras, and attributed the activity to Earth Lusca.PakistanESET found Windows variants of the SprySOCKS backdoor used in attacks against government organizations in Taiwan, Thailand, Pakistan, and Honduras, and attributed the activity to Earth Lusca.TaiwanESET found Windows variants of the SprySOCKS backdoor used in attacks against government organizations in Taiwan, Thailand, Pakistan, and Honduras, and attributed the activity to Earth Lusca.ThailandESET found Windows variants of the SprySOCKS backdoor used in attacks against government organizations in Taiwan, Thailand, Pakistan, and Honduras, and attributed the activity to Earth Lusca.
Industries
Foreign affairsSprySOCKS has been linked to the Chinese threat group ‘Earth Lusca,’ which deployed it in attacks against government entities focused on foreign affairs, technology, and telecommunications.GovernmentESET found Windows variants of the SprySOCKS backdoor used in attacks against government organizations in Taiwan, Thailand, Pakistan, and Honduras, and attributed the activity to Earth Lusca.TechnologySprySOCKS has been linked to the Chinese threat group ‘Earth Lusca,’ which deployed it in attacks against government entities focused on foreign affairs, technology, and telecommunications.TelecommunicationsSprySOCKS has been linked to the Chinese threat group ‘Earth Lusca,’ which deployed it in attacks against government entities focused on foreign affairs, technology, and telecommunications.