FishMonger Hackers Deploy SprySOCKS Backdoor to Windows, Adding Stealth Features

Key Takeaways

• The Chinese state-backed threat group FishMonger has broadened its cyberespionage toolkit by adapting its SprySOCKS backdoor for Windows systems.
• This new Windows variant, previously exclusive to Linux, incorporates advanced stealth features, including a kernel driver to evade detection.
• Victims identified between 2023 and 2024 include government entities in Honduras, Taiwan, Thailand, and Pakistan.
• The backdoor provides extensive control, enabling system enumeration, file manipulation, keylogging, and remote command execution.

FishMonger Expands SprySOCKS Backdoor to Windows with Advanced Stealth

The Chinese cyberespionage collective known as FishMonger has significantly enhanced its operational reach by porting its sophisticated SprySOCKS backdoor to Windows environments. This strategic shift marks a critical escalation, as the malware, initially documented targeting Linux systems, now includes advanced stealth capabilities designed for a broader spectrum of attacks. A comprehensive analysis of this expanded threat is detailed in a recent report by security researchers.

The threat actor, identified as FishMonger, has introduced its SprySOCKS backdoor to Windows for the first time, diverging from its previous exclusive deployment on Linux. This evolution indicates the group’s intent to expand its targeting capabilities, potentially impacting a wider global victim base. The initial emergence of SprySOCKS was noted in September 2023, when Trend Micro reported on a Linux variant actively used in espionage campaigns. At that time, the backdoor, built upon the open-source Windows remote access tool Trochilus but heavily modified, was primarily associated with attacks against governmental organizations across Asia.

New Windows Variants Uncovered

Analysts at WeLiveSecurity have identified two previously undocumented Windows iterations of SprySOCKS, internally designated as WIN_DRV and WIN_PLUS. According to a report shared with Cyber Security News (CSN), ESET’s telemetry confirms active campaigns between 2023 and 2024, with government entities in Honduras, Taiwan, Thailand, and Pakistan among the victims. Initial samples were submitted to VirusTotal in April 2024, contained within an archive named klelam00007.zip. FishMonger is believed to operate under I-SOON, a Chinese contractor, and is part of the larger Winnti Group.

Historically, the group has targeted universities in Hong Kong during the 2019 civil protests and is known for employing watering-hole attacks. Their diverse toolkit includes other sophisticated malware such as ShadowPad, Spyder, Cobalt Strike, FunnySwitch, and the BIOPASS RAT. The expansion of SprySOCKS to Windows clearly demonstrates a continued investment in their offensive capabilities.

Both Windows variants of SprySOCKS implement over 30 command-and-control (C2) commands, facilitating comprehensive system enumeration, file management, service control, and keylogging. ESET researchers also noted indications suggesting the potential involvement of a UEFI bootkit component in some attacks, possibly exploiting CVE-2023-24932. Such an exploit could allow the malware to persist even after a complete operating system reinstallation.

Advanced Evasion Techniques of WIN_DRV and WIN_PLUS

The WIN_DRV variant employs a kernel driver, RawWNPF, to render the backdoor virtually undetectable on compromised systems. This driver effectively conceals the malware’s network connections, running processes, files, and registry keys from standard system monitoring tools. Even diagnostic utilities like netstat.exe fail to display active backdoor connections, as the driver intercepts Windows Filtering Platform calls and purges relevant entries from the output.

To circumvent Windows security checks and load the kernel driver, the attackers leveraged a leaked code-signing certificate from the PastDSE project found on GitHub. Once activated, the driver initiates TCP traffic diversion, enabling attackers to transmit commands through any open TCP port without needing to know the specific listening port. This technique significantly complicates efforts for network defenders to trace the true destination of suspicious traffic.

The WIN_PLUS variant establishes persistence through DLL side-loading, scheduled tasks, and the manipulation of print processor registry entries. Both variants utilize 128-bit AES encryption with the hardcoded key “uXQLESMXGaRMs6BL” to decrypt their payloads, which are then injected into a legitimate svchost.exe process via process doppelganging. Chinese-language debug paths embedded within the binaries confirm the malware’s development in China, with internal strings suggesting the project commenced as early as April 2023.

Backdoor Capabilities and C2 Communication

Both SprySOCKS variants establish communication with their C2 server over TCP, UDP, and WebSocket protocols. The WIN_PLUS version includes a hardcoded C2 address, 207.148.78[.]36, which operates across all three communication channels on ports 443, 53, and 80. The backdoor also creates a Windows firewall rule to permit inbound traffic on TCP port 53781. This infrastructure overlaps with a delivery server at 207.148.75[.]122, previously observed in a June 2023 campaign.

The SprySOCKS backdoor offers a comprehensive suite of functionalities, including keylogging, clipboard data capture, file transfer capabilities, SOCKS proxy functionality, and remote shell access via cmd.exe. Keylogging is conditionally activated, requiring the presence of a specific INI file at %appdata%MicrosoftVaultlgf.dat with a key value set to 1. Captured keystrokes are then saved to lg.dat, encrypted using single-byte XOR with the key 0x44.

What You Should Do

• Organizations should actively monitor for any indicators of FishMonger activity, as advised by ESET.
• Ensure all public-facing servers are fully patched, as FishMonger frequently leverages N-day vulnerabilities for initial access.
• Implement robust endpoint detection and response (EDR) solutions to detect suspicious processes, network connections, and file modifications.
• Regularly audit scheduled tasks, print processor registry entries, and the Windows Fonts folder for unusual or unexpected files, which could indicate compromise.
• Consider advanced threat hunting techniques to uncover hidden network connections or processes that may be obscured by kernel drivers.
• Review and strengthen access controls, especially for administrative privileges, to limit potential lateral movement.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.