ESET details FishMonger’s Windows SprySOCKS backdoor variants and kernel-driver stealth
Summary
ESET analyzed two Windows variants of FishMonger’s SprySOCKS backdoor, active from 2023 to 2024 against government victims in four countries. One variant uses a kernel driver to hide activity and redirect TCP traffic.
Key points
- ESET identified WIN_DRV and WIN_PLUS, previously undocumented Windows versions of the Linux-associated SprySOCKS backdoor.
- Telemetry showed activity in 2023–2024, mainly targeting government organizations in Honduras, Taiwan, Thailand, and Pakistan.
- Both variants support TCP, UDP, and WebSocket command-and-control and offer more than 30 commands, including file operations, process and service management, and data collection.
- WIN_DRV uses kernel drivers to hide processes, files, registry keys, and network connections, and can divert specially crafted TCP traffic to its hidden backdoor port.
- The malware uses persistence methods including scheduled tasks, print processors, and Image File Execution Options; loaders use DLL side-loading and process doppelgänging.
- Both variants can log keystrokes and clipboard data when enabled by a configuration file.
- ESET attributes the Windows variants to FishMonger with high confidence; telemetry provides limited indications of possible UEFI bootkit involvement, potentially exploiting CVE-2023-24932.
Article Details
- Attack Vectors
- Initial access in this campaign was not confirmed. ESET says misconfigured or unpatched public-facing applications are a possibility, based on victim systems and FishMonger's usual methods; the group has also been known to exploit server-side N-day vulnerabilities.
- WIN_DRV uses DLL side-loading through a legitimate signed executable to load the SprySOCKS loader.
- WIN_DRV establishes persistence with a scheduled task; WIN_PLUS installs a malicious loader as a print processor.
- The WIN_DRV variant uses a kernel driver to hide files, processes, registry keys, and network activity, and to divert specially crafted TCP traffic to its backdoor.
- Defensive Notes
- ESET advises monitoring FishMonger's activities given limited indications that some attacks may involve a UEFI bootkit, possibly exploiting CVE-2023-24932.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 207[.]148[.]75[.]122 | IP reported as used by FishMonger operators as a SprySOCKS delivery server in June 2023. |
| IPV4 | 207[.]148[.]78[.]36 | SprySOCKS WIN_PLUS command-and-control IP hardcoded in the backdoor configuration. |
| SHA1 | 037db2445f3d72388cb2cf8510563148e5a184be | Hash of the batch script identified as persisting the WIN_DRV SprySOCKS variant. |
| SHA1 | 2457eed2ab28e37741f10914ef929dad2c8079d4 | Hash of VSPMsg.dll, identified as the first-stage loader for SprySOCKS. |
| SHA1 | 44dc4a08c5eb0972c8e18b0e01284e06f09006bb | Hash of bthcam.sys, identified as the SprySOCKS DriverLoader driver. |
| SHA1 | 5f3b87cef56683d9a9e19186e0fd0d8019b559c4 | Hash of the SprySOCKS loader. |
| SHA1 | 621d1952839be4b0a1b0e66e87bce5062ca368ed | Hash of tpsvcloc.dll, identified as the SprySOCKS loader. |
| SHA1 | 6490b8e4aade25a3ee2da9a47f312db2122470bc | Hash of the encrypted container holding WIN_DRV SprySOCKS and its drivers. |
| SHA1 | 955bfc3dcc867256f9f46a606deb0779fa3416d8 | Hash of the encrypted SprySOCKS DriverLoader driver, listed as a malware indicator. |
| SHA1 | ab87b29b6f79487c75ca08d102e79001e536f083 | Hash of the encrypted SprySOCKS RawWNPF driver. |
| SHA1 | c793ca31e3f6628b5c8986146953bf66232e9a30 | Hash of the encrypted container holding the WIN_PLUS SprySOCKS backdoor and loader. |
| SHA1 | d2c706b1eaf662bf0ce124b5032f73ed84bda24a | Hash of the WIN_PLUS SprySOCKS backdoor. |
| SHA1 | e7484c24b88a1a2407a8f09d734f9a993670285b | Hash of the ZIP archive containing the WIN_DRV variant and its components. |
MITRE ATT&CK
T1007 · System Service DiscoverySprySOCKS supports enumerating services on the compromised system.T1008 · Fallback ChannelsSprySOCKS supports TCP, UDP, and WebSocket command-and-control channels.T1010 · Application Window DiscoverySprySOCKS records the active window title as part of its keylogging functionality.T1014 · RootkitThe RawWNPF kernel driver hides SprySOCKS files, processes, registry keys, and network activity.T1027.007 · Dynamic API ResolutionThe article reports dynamic API resolution in SprySOCKS components.T1027.013 · Encrypted/Encoded FileSprySOCKS components are stored in AES-encrypted files on the victim's system.T1041 · Exfiltration Over C2 ChannelSprySOCKS supports uploading files from the compromised system through its command-and-control channel.T1053.005 · Scheduled TaskThe WIN_DRV batch script creates a scheduled task that runs the loader at system startup.T1055.013 · Process DoppelgängingThe loader uses process doppelgänging to inject SprySOCKS into svchost.exe.T1056.001 · KeyloggingSprySOCKS implements a keylogger that records keystrokes when its configuration enables the feature.T1059.003 · Windows Command ShellSprySOCKS can launch an interactive cmd.exe shell for remote command execution.T1070.004 · File DeletionThe loaders delete files from the original deployment directory after copying components into their persistence locations.T1070.009 · Clear PersistenceAfter loading the minifilter driver, the WIN_DRV loader deletes the service registry key it created for the driver.T1082 · System Information DiscoverySprySOCKS collects system details including computer name, OS version, memory, CPU, and privileges.T1083 · File and Directory DiscoverySprySOCKS supports listing files and directories on the compromised system.T1095 · Non-Application Layer ProtocolSprySOCKS communicates with its command-and-control server using TCP and UDP channels as well as WebSocket.T1106 · Native APIThe loader uses Windows APIs including CreateProcessAsUserW and NtLoadDriver during execution.T1115 · Clipboard DataWhen keylogging is enabled, SprySOCKS logs clipboard data along with keystrokes.T1124 · System Time DiscoverySprySOCKS collects the current system time.T1132.001 · Standard EncodingSprySOCKS base64-encodes data in its command-and-control protocol.T1134.002 · Create Process with TokenThe WIN_DRV loader creates svchost.exe using a token obtained from spoolsv.exe.T1140 · Deobfuscate/Decode Files or InformationThe loaders decrypt SprySOCKS payloads from encrypted containers before execution.T1205.002 · Socket FiltersRawWNPF installs packet filters that divert TCP traffic containing specially crafted data to the backdoor's configured local port.T1497 · Virtualization/Sandbox EvasionThe first-stage loader exits unless executed by spoolsv.exe, a check described as hiding its behavior from automated sandboxes.T1518.001 · Security Software DiscoveryThe loader checks for libraries associated with security and sandboxing products and exits if it finds them.T1546.012 · Image File Execution Options InjectionThe loader can register its executable as a debugger for vds.exe through the Image File Execution Options registry key.T1547.012 · Print ProcessorsWIN_PLUS establishes persistence by registering its loader as a Windows print processor.T1562.004 · Disable or Modify System FirewallSprySOCKS adds a firewall rule allowing inbound TCP traffic to its listening port.T1569.002 · Service ExecutionThe malware uses Windows services, including restarting the Virtual Disk Service or print spooler to trigger execution.T1571 · Non-Standard PortThe WIN_PLUS configuration uses TCP 443, UDP 53, and WebSocket 80 for command-and-control.T1573.001 · Symmetric CryptographySprySOCKS encrypts and decrypts command-and-control data using 128-bit AES.T1574.002 · DLL Side-LoadingWIN_DRV side-loads the malicious tpsvcloc.dll through a legitimate signed executable and library.T1587.001 · MalwareThe article attributes development of the custom SprySOCKS backdoor to FishMonger.T1590.005 · IP AddressesSprySOCKS collects network adapter information and assigned IP addresses from the compromised device.T1592.004 · Client ConfigurationsSprySOCKS collects victim host details including computer name, OS version, memory and CPU information, privileges, and system language.T1614.001 · System Language DiscoverySprySOCKS collects the system language from the compromised device.T1622 · Debugger EvasionThe article reports that RawWNPF uses KdDisableDebugger to disable an active kernel debugger.T1665 · Hide InfrastructureRawWNPF hides active backdoor connections from network tools such as netstat.exe.
CVE
Threat Actors
Aquatic PandaNamed in the article as an alternate name for FishMonger.Earth LuscaNamed in the article as an alternate name for FishMonger.FishMongerCyberespionage group attributed with high confidence by ESET as responsible for the Windows SprySOCKS variants.Red Dev 10Named in the article as an alternate name for FishMonger.TAG-22Named in the article as an alternate name for FishMonger.Winnti GroupThe article places FishMonger under the Winnti Group umbrella.
Malware
BIOPASS RATFishMonger’s toolset includes ShadowPad, Spyder, Cobalt Strike, FunnySwitch, SprySOCKS, and the BIOPASS RAT.FunnySwitchFishMonger’s toolset includes ShadowPad, Spyder, Cobalt Strike, FunnySwitch, SprySOCKS, and the BIOPASS RAT.RedLeavesWindows remote access trojan (RAT) named Trochilus, and shares several common characteristics with the RedLeaves backdoor; nevertheless, it was extended and modified enough to be considered a new backdoor.ShadowPadFishMonger’s toolset includes ShadowPad, Spyder, Cobalt Strike, FunnySwitch, SprySOCKS, and the BIOPASS RAT.SprySOCKSESET researchers have discovered two as-yet undocumented Windows variants of SprySOCKS, a previously Linux-only backdoor reportedly used by FishMonger, the group believed to be operated by a Chinese contractor namedSpyderFishMonger’s toolset includes ShadowPad, Spyder, Cobalt Strike, FunnySwitch, SprySOCKS, and the BIOPASS RAT.TrochilusThe code of the backdoor is based on an open-source Windows remote access trojan (RAT) named Trochilus, and shares several common characteristics with the RedLeaves backdoor; nevertheless, it was extended and modified
Vendors
Products
Tools
Countries
Chinais a cyberespionage group that falls under the Winnti Group umbrella and is most likely operating out of China, from the city of Chengdu.Hondurassamples on VirusTotal, ESET telemetry shows real activity between 2023 and 2024, with several victims in Honduras, Taiwan, Thailand, and Pakistan, targeting mostly government organizations.Hong KongWe published an analysis of FishMonger in early 2020 when it heavily targeted universities in Hong Kong during the civic protests that started in June 2019.Pakistanshows real activity between 2023 and 2024, with several victims in Honduras, Taiwan, Thailand, and Pakistan, targeting mostly government organizations.TaiwanVirusTotal, ESET telemetry shows real activity between 2023 and 2024, with several victims in Honduras, Taiwan, Thailand, and Pakistan, targeting mostly government organizations.ThailandESET telemetry shows real activity between 2023 and 2024, with several victims in Honduras, Taiwan, Thailand, and Pakistan, targeting mostly government organizations.