China-Linked SprySOCKS Backdoor Expands to Windows with Driver-Based Stealth
Summary: ESET reported two previously undocumented Windows variants of the SprySOCKS backdoor, internally marked WIN_DRV and WIN_PLUS, both with hard-coded command-and-control configurations and support for TCP, UDP, and WebSocket communications and more than 30 commands. WIN_DRV uses a kernel driver called RawWNPF loaded via an encrypted driver named DriverLoader to conceal network connections, processes, files, and registry keys, while WIN_PLUS starts from the Windows Print Spooler service and injects a loader into a new svchost.exe process.
What's compelling: ESET attributes SprySOCKS to FishMonger, a China-nexus espionage group tied to contractor i-Soon and the Winnti umbrella, with artifacts possibly deployed between 2023 and 2024 against government organizations in Honduras, Taiwan, Thailand, and Pakistan - and the group has previously exploited N-day flaws in Fortinet, GitLab, Exchange Server, Telerik UI, and Zimbra to get in.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026