SprySOCKS Windows variants target government networks

Security firm ESET has identified Windows-based versions of the SprySOCKS malware, a backdoor previously confined to Linux systems. The malware has been deployed in targeted attacks against government organizations in Taiwan, Thailand, Pakistan, and Honduras, with a focus on foreign affairs, technology, and telecommunications sectors. ESET attributes the campaign to Earth Lusca, a Chinese advanced persistent threat (APT) group also known by aliases including FishMonger, Aquatic Panda, and Red Dev 10.

The discovery highlights the group’s expanding toolset, which now includes kernel-level capabilities designed to conceal malicious activity on compromised systems. While the original Linux variant provided remote access and control, the Windows versions introduce additional evasion techniques to bypass standard detection methods.

How the malware operates

The Windows variants of SprySOCKS appear in two forms: WIN_DRV and WIN_PLUS. Both retain the core functionality of the Linux version, enabling communication over TCP, UDP, and WebSocket protocols, as well as execution of over 30 command-and-control (C2) instructions. The malware can collect system information, manage processes and files, and function as a SOCKS proxy. It also includes keylogging and clipboard monitoring features to capture user activity.

The WIN_DRV variant distinguishes itself by incorporating a kernel driver named RawWNPF, loaded via another driver called DriverLoader (fsdiskbit.sys). This driver, signed with a leaked certificate from the GitHub PastDSE project, allows the malware to hide processes, network connections, files, and Registry keys from security tools. Persistence is maintained through scheduled tasks and Image File Execution Options (IFEO) using the vds.exe process. Additionally, WIN_DRV can redirect incoming TCP traffic to the backdoor without exposing its actual listening port, complicating network-based detection.

In contrast, the WIN_PLUS variant lacks the kernel driver but achieves persistence by registering as a Windows Print Processor. While it omits the advanced stealth features of WIN_DRV, it retains the core backdoor capabilities of the original malware.

Detection and response

ESET’s telemetry suggests a possible link to a UEFI bootkit component, potentially exploiting CVE-2023-24932, a Secure Boot vulnerability previously associated with the BlackLotus UEFI malware. However, ESET has not provided conclusive evidence connecting the two threats. The firm’s report includes indicators of compromise (IoCs) to assist organizations in identifying and mitigating infections.

The emergence of Windows variants demonstrates Earth Lusca’s efforts to broaden its attack surface. Organizations in sectors frequently targeted by state-sponsored actors should adopt multi-layered defense strategies to counter evolving threats.

What to watch

Government, technology, and telecommunications entities should remain alert for signs of Earth Lusca activity. The group’s use of kernel-level techniques and traffic diversion indicates a focus on long-term persistence and evasion. Future developments may involve further exploitation of UEFI vulnerabilities or additional stealth mechanisms. Security teams are advised to review ESET’s technical analysis and integrate the provided IoCs into their threat detection frameworks.