ESET has discovered two new Windows variants of the SprySOCKS backdoor attributed to the FishMonger group. Active between 2023 and 2024 against government entities in Honduras, Taiwan, Thailand and Pakistan, they support communications via TCP, UDP and WebSocket and implement over 30 commands. The WIN_DRV variant employs a kernel driver to hide a TCP backdoor and redirect traffic
ESET Research has detected two previously undocumented variants of SprySOCKS for Windows (WIN_DRV and WIN_PLUS), a backdoor previously only available for Linux and allegedly used by FishMonger, the group believed to be run by a Chinese contractor called I-SOON. While ESET initially discovered the malware samples on VirusTotal uploaded in April 2024, ESET telemetry data highlights actual activity between 2023 and 2024, with numerous victims in Honduras, Taiwan, Thailand and Pakistan, primarily affecting government entities and organizations.
The WIN_DRV variant supports over 30 Command & Control (C&C), which enable various operations, including system information collection and process detection, service and file management, including viewing, creating, deleting and transferring them.
In addition to the basic backdoor functionality, FishMonger employs a kernel-mode driver to provide advanced stealth capabilities. SprySOCKS exploits this driver to hide network connections, processes, files, and registry keys associated with the malware, as well as implement TCP traffic diversion mechanisms. This allows operators to issue commands to the backdoor via an arbitrary TCP port on the compromised system, without revealing in network traffic the actual listening port used by the backdoor.
"The Windows variant retains most of the basic architecture of its Linux counterpart, including the C&C protocol, encryption algorithms and command handling logic. At the same time, it replaces operating system-specific components with native Windows mechanisms and strengthens the stealth capabilities of the backdoor through the use of kernel drivers. In light of the limited but significant evidence suggesting a possible use of a UEFI bootkit, it is recommended to continue to carefully monitor the group's activities," says Martin Smolár, a researcher at ESET who has discovered and analyzed the latest arsenal used by FishMonger.
Based on ESET telemetry data, there is limited indication that some SprySOCKS attack scenarios could involve a UEFI bootkit component, potentially exploiting the CVE 2023 24932 vulnerability.
FishMonger, believed to be run by a Chinese contractor called I-SOON, is a cyberespionage group part of the Winnti Group and most likely operating from the city of Chengdu, China. The group is also known as Earth Lusca, TAG-22, Aquatic Panda or Red Dev 10. In early 2020, ESET Research published an analysis on FishMonger, highlighting how the group had heavily targeted universities in Hong Kong during the civil protests that began in June 2019. The group is also known to conduct “watering-hole” attacks, a technique that compromises websites frequented by the intended victims to infect their users. systems. FishMonger's toolset includes ShadowPad, Spyder, Cobalt Strike, FunnySwitch, SprySOCKS, and the BIOPASS remote access trojan (RAT).
