【CyCraft Monthly Intelligence】China-Backed Hacking Group FishMonger Upgrades SprySOCKS to Target Government Networks in Multiple Countries for Long-Term Persistence

Threat and Impact

Recent research shows that FishMonger has upgraded its SprySOCKS malware from the previously known Linux backdoor into two Windows variants, significantly enhancing the group's cyber-espionage capabilities.

Between 2023 and 2024, the research team observed campaigns primarily targeting government agencies in Taiwan, Honduras, Thailand, and Pakistan, indicating an operation focused on intelligence collection rather than financially motivated cybercrime. FishMonger has previously targeted politically sensitive and institutional targets, and the victim profile of this activity is consistent with the group's historical behavior, allowing high-confidence attribution to FishMonger. SprySOCKS's move to the Windows system indicates the group is pursuing broader access to enterprise and government environments, where Windows remains the dominant OS.

From a threat perspective, this incident is notable not only for the malware itself but also for its stealth and persistence capabilities. Both Windows variants provide full backdoor access, allowing operators to collect system information, managed files and services, execute commands, and potentially exfiltrate data. The malware also supports keylogging and clipboard capture, further increasing the risk of credential theft, document theft, and surveillance of victim activity.

One of the variants, WIN_DRV, incorporates kernel-level components that can hide files, processes, registry keys, and network connections, making incident detection and response more difficult, and supports long-term privileged account access, making it a greater threat. There are also indications that some attack scenarios involve UEFI bootkit components, possibly related to CVE-2023-24932, suggesting the attackers may be pursuing longer-term persistence capabilities.

For affected industries, especially the public sector, the overall impact is substantial. Government networks compromised by this toolset may face:

• Long-term unauthorized access
• Theft of sensitive internal data
• Monitoring of user activity and communications
• Use of compromised systems as covert access points or proxy nodes
• Forensic investigation hindered by rootkit-like evasive techniques.

Analyst Perspective

FishMonger, also known as Earth Lusca and TAG-22, previously developed the SprySOCKS backdoor exclusively for Linux. Its expansion into the Windows environment indicates that the group's attack scope has broadened and become more focused on enterprise environments. FishMonger is also believed to be linked to the Chinese company i-Soon and can be regarded as one of its affiliated APT groups, primarily targeting victims outside China.

‍

Technical Details

At the core of this incident are two previously undocumented Windows versions of the SprySOCKS backdoor used byFishMonger: WIN_DRV and WIN_PLUS. Both retain the core architecture known from SprySOCKS on Linux, including multi-protocol command and control, encrypted message transmission, and extensive remote management capabilities, while adding native persistence, injection, and concealment mechanisms on Windows.The key technical difference is that WIN_DRV adds a kernel-mode toolchain, including the DriverLoader and RawWNPF drivers, used to hide files, processes, registry keys, and network activity, whereas WIN_PLUS uses a lighter-weight, print-processor-based execution chain without a rootkit component. Together,these elements explain not only what the malware can do, but also how itmaintains persistent concealment and resilience on compromised hosts.

Reconnaissance

Once executed, SprySOCKS cancollect detailed host and network information to support the operators' situational awareness and follow-on task configuration. Its system informationcommand gathers the victim's computer name, OS version, memory and CPU details, privileges, language, time, and backdoor version, as well as network adapterinformation and assigned IP addresses. This indicates the malware is designed to quickly profile a compromised machine and assess its value and role within the environment.

Resource Development

This operation relies on a custom malware platform rather than simply using off-the-shelf tools. SprySOCKS itselfis a development effort rooted in earlier codebases, such as Trochilus, but has been substantially extended into an independent backdoor family. The Windows variants are also under continued development, especially the WIN_DRV branch,which introduces a dedicated in-memory driver loader and rootkit-grade kernelcomponents for concealment and covert access.

Initial Access

The exact intrusion vector has not been confirmed, but available intelligence strongly suggests FishMonger maygain access through Internet-facing servers, consistent with its known patternof exploiting server-side N-day vulnerabilities or abusing misconfigured, unpatched Internet-facing applications. Some of the affected systems run serveroperating systems, which further supports this likely pathway.

Execution

The execution chains differ between variants, but both are designed to launch the backdoor via staged loaders and trusted Windows components.

• For WIN_DRV,the archive contains a batch script, a legitimately signed binary, a malicious DLL, and an encrypted payload container. The script copies the components to%SystemRoot%\Fonts and creates a scheduled task named ApphostRagistreationVerifier so that it runs as NT AUTHORITY\SYSTEM at system startup. The attacker then abuses DLL Side-Loading: a renamed legitimate executable, ApphostRagistreationVerifier.exe, loads the legitimate tpsvc.dll, which in turn loads the malicious loader tpsvcloc.dll.
  The loader uses a hardcoded key to decryptits payload container in AES-128 ECB mode: uXQLESMXGaRMs6BL
  It then extracts the backdoor and driver payloads, and using a token obtained from spoolsv.exe, creates a newsvchost.exe process via CreateProcessAsUserW. The malware then uses process doppelgänging to inject shellcode into that process. Files temporarily dropped in %TEMP% use the TH prefix.
• For WIN_PLUS, execution begins with the first-stage loader VSPMsg.dll, which is designed to run only as a print processor under spoolsv.exe. It decrypts the second-stage loader from the following location: C:\Windows\System32\spool\drivers\color\config.dat
  The second-stage loader then decrypts the backdoor from the same container and likewise uses process doppelgänging to inject it into a newly created svchost.exe.
  The backdoor itself also supports direct remote execution through its command set, including launching an interactive console and executing files already present on disk.

Persistence

FishMonger uses several native Windows persistence mechanisms that vary by variant.

• For WIN_DRV, persistence is initially established via a scheduled task that launches the Side-Loading chain at every boot. If this configuration does not exist, the loader can alsoestablish persistence on its own: it copies files to %SystemRoot%\Fonts andabuses Image File Execution Options (IFEO). Specifically, it writes:
  HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File ExecutionOptions\vds.exe\debugger
  pointing it to %SystemRoot%\Fonts\ApphostRagistreationVerifier.exeso that the malware launches whenever vds.exe is triggered. It also drops and executes affair-build.bat, which deletes the original deployment files and restarts the vds service, relaunching the malware from its new location.
• For WIN_PLUS, persistence relies on abuse of print processors. The first-stageloader creates: HKLM\SYSTEM\ControlSet001\Control\Print\Environments\Windowsx64\Print Processors\VSPMsg
  and sets the Driver value to VSPMsg.dll. It then copies VSPMsg.dll to the print spooler's print processor directory and moves config.dat to the print spooler's color driver path. Finally, it restarts the Print Spooler service so that spoolsv.exe automatically loads the malicious print processor.

Privilege Escalation

The real privilege escalation in this operation occurs in kernel mode, where WIN_DRV decrypts and loads the signed kernel driver fsdiskbit.sys, which acts as a DriverLoader. It does so by first creating the service registry key msidiskserver (whose ImagePath value points to the dropped driver file), then calling the NtLoadDriver API with that registry key as a parameter to load the driver into the kernel.

Once loaded, fsdiskbit.sys is responsible for decrypting a second driver, RawWNPF, and manually mapping it into kernel memory, directly executing its entry point rather than loading it through normal service registration. This allows RawWNPF to operate without leaving the traces of normal driver loading, granting the attacker rootkit-level capabilities.

To allow fsdiskbit.sys to pass kernel driver signature enforcement requirements, the operators signed it with a leaked certificate obtained from the PastDSE projecton GitHub, apparently intended to bypass Driver Signature Enforcement (DSE) on at least some outdated or misconfigured systems.

Defense Evasion

At the user-mode level, the loader performs anti-analysis checks, searching for DLLs associated with sandboxes or security products, such as snxhk.dll, SxWrapper.dll, SxIn.dll, SXIn64.dll, and SbieDll.dll. If any are found, it halts execution. WIN_PLUS's first-stage loader also checks whether it is running under spoolsv.exe, to evade automated sandboxes that fail to emulate acorrect print processor environment.

AES-encrypted containers, encrypted strings, and dynamic API resolution protect the payload and strings, increasing the difficulty of static analysis, and allow the malicious code to execute inside a newly created svchost.exe process.

WIN_DRV then extends its evasion capabilities to the kernel level through RawWNPF, which acts as a rootkit. It can:

• Hideprocesses by hooking NtQuery System Information
• Hide active network connections from tools such as netstat.exe
• Hide and protect malicious files via a minifilter callback
• Hide IFEO persistence registry keys via a registry callback
• Delete traces of its own driver file and temporary service registration.

One particularly notable technique is TCP traffic redirection. RawWNPF registers a Windows Filtering Platform (WFP) filter and inspects IPv4 packets. When it detects specially crafted TCP data, the driver quietly redirects traffic received on any open TCP port to a hidden backdoor listener. This allows operators to reach the implant without exposing the actual listening port in normal traffic inspection.

The malware also modifies the firewall via netsh.exe, deleting and recreating a rule named:
CoreNetworking - Packet Too Big(ICMPv6 - In)
but replacing it with a rule that allows inbound TCP traffic to the backdoor's listening port. This disguises malicious access behind a seemingly legitimate firewall rule name.

Credential Access

SprySOCKS includes optional keylogging and clipboard capture functionality. This featureis only enabled when the following file:
%appdata%\\\\Microsoft\\\\Vault\\\\lgf.dat
contains the setting key=1.
Once enabled, the malware creates a mutex named:
Global\\\\{DCAA7ED8-521B-4EAB-BE21-65254CF59239}
and logskeystrokes, clipboard content, and the title of the currently active window to:%appdata%\\\\Microsoft\\\\Vault\\\\lg.datz

The captured data is encrypted with a simple XOR key of 0x44.

Discovery

Once active, the backdoor supports extensive discovery operations. Through its C2 commands, it can:

• Enumerate all running processes
• List the modules loaded by a specified process
• Enumerate all services
• List files in a specified directory
• Enumerate recent files from Windows and Office recent items directories
• Retrieve available disk space
• Collect detailed host configuration and network information

It also retrieves the foreground window title within its keylogging subsystem, helping operators understand what the user is doing and identify applications of interest.

Collection

This operation primarily collects user activity and file access. The malware's keylogger records keystrokes, clipboard data, and the content of the active window, while its file management commands let operators browse directories and identify valuable documents. It also includes a command to enumerate recent files, which is especially useful for espionage operations since it highlights content the victim has recently opened or edited.

Command and Control (C2)

SprySOCKS supports three communication protocols: TCP, UDP, and WebSocket. It can function either as a client or a server, giving FishMonger high flexibility inhow it maintains control.

In theobserved WIN_PLUS configuration, the hardcoded C2 server is:

• 207.148.78[.]36:443 for TCP
• 207.148.78[.]36:53 for UDP
• 207.148.78[.]36:80 for WebSocket

The backdoor also supports a local listener. In WIN_PLUS, the TCP listener is configured on port 53781. In WIN_DRV, if no C2 address is configured, the malware starts a passive TCP backdoor on a random local port and hides that port via RawWNPF.

Its C2 protocol uses a custom packet format. For TCP, each message begins with a12-byte header containing a CRC, the magic value 0xACACBCBC, and the payload size. UDP and WebSocket use different header formats and magic values, with UDP using 0xACACBFBC and WebSocket using a masking key of 0x1BDCCBAA. After the header, the payload contains another CRC, a value of 0x0003 that may be used to identify the encryption method, and data encrypted with AES-128-ECB using the hardcoded key: QFTHEYjzX3RBOMgZ.

The encrypted data is then base64-encoded.

Its command set includes more than 30 message IDs, covering system information collection, process and service control, interactive shell access, file transfer, SOCKS proxying, and execution of additional files.

Exfiltration

SprySOCKS can exfiltrate files directly through its C2 channel. Its command set includes an explicit upload function that lets operators send selected files from the victim host back to the C2 infrastructure. Because command traffic and exfiltration traffic use the same encryption and encoding channel, exfiltration activity blends in with ordinary malware communications.

‍

Mitigation

SprySOCKS's intrusion chain is initial access via Internet-facing servers →execution via DLL Side-Loading →multiple native persistence mechanisms →kernel-level rootkit concealment →flexible C2. The guiding principle for mitigation is to place controls at each stage that actually block the technique, rather than relying solely on after-the-fact detection. The following recommendations are ordered by “prevention first, detection as reinforcement,” with each item indicating the attack technique it addresses.

Block Initial Access (Addresses: Server-SideN-Day Vulnerabilities / Internet-Facing Application Abuse)

Since most subsequent persistenceand driver-loading steps require administrator privileges first, blockinginitial intrusion is the most cost-effective line of defense.

• Prioritize patching Internet-facing servers, remote management interfaces, and Internet-facing applications, and remove unnecessary external-facing services.
• Apply least privilege to Internet-facing Windows servers, ensuring service accounts do not have local administrator rights, to deny attackers the privilege foundation needed to create scheduled tasks, print processors, and kernel services.
• Use network segmentation to isolate Internet-facing hosts from sensitive internal services, limiting the blast radius if a single host is compromised.

Blocking Side-Loading and File-Based Persistence with Application Control (Addresses: DLL Side-Loading, Scheduled Tasks, IFEO, Print Processors)

This is a key control that canblock multiple techniques at once. SprySOCKS relies on executing renamed,legitimately signed files from non-standard directories to side-load maliciousDLLs.

• Deploy WDAC or AppLocker to prohibit executing EXE/DLL files from non-standard paths such as %SystemRoot%\Fonts\, spool\drivers\color\, spool\prtprocs\x64\, and %TEMP%. This directly prevents the ApphostRagistreationVerifier.exe → tpsvc.dll →tpsvcloc.dll Side-Loading chain and the VSPMsg.dll print processor from executing.
• Enable legitimate parent-process baselining for svchost on servers and have EDR detect process doppelgänging and anomalously created svchost.exe instances (spoolsv.exe token + CreateProcessAsUserW).

Harden Kernel and Boot Protections to Directly Dismantle the Rootkit (Addresses: fsdiskbit.sys / RawWNPF / Leaked Certificate Signing / UEFI Bootkit)

WIN_DRV's most dangerous characteristic is its ability to execute and conceal malicious activity at the kernel level. Driver Signature Enforcement (DSE) alone is not sufficient to stop this kind of attack: fsdiskbit.sys is signed with a leaked but legitimate certificate, so if the certificate has not been revoked, or the corresponding blocking rules have not been applied, it can still pass signature verification and be loaded. Attackers therefore specifically target systems that are not fully updated or that lack advanced kernel protection mechanisms enabled. The following measures are recommended:

• Enable HVCI/ Memory Integrity (VBS): blocking manually mapped, unsigned code such as RawWNPF from executing in the kernel is the single most effective control for dismantling the rootkit.
• Deploy the Microsoft Vulnerable Driver Blocklist (WDAC driver blocklist) and blockfsdiskbit.sys by hash/certificate; validly signed malicious drivers can only be stopped through blocklisting and certificate revocation.
• Confirm Secure Boot is enabled and apply the boot updates and revocations (SBAT/DBX) related to CVE-2023-24932, to close off the potential UEFI bootkit pathway.

Block C2 and Hidden Listeners with Network-Side Controls (Addresses: Firewall Tampering, WFP Redirection,TCP/UDP/WS C2)

Because the malware tampers with the host firewall and hides connections from netstat, the host-level view cannot be trusted, and the network perimeter must serve as the reliable control point.

• Implement strict egress filtering at the network firewall (not the host firewall): block207.148.78[.]36 and restrict abnormal outbound server connections such asTCP/443, UDP/53 (allow only to approved DNS), and TCP/80.
• WFP redirection only works on TCP ports that are already open, so restricting inbound ports to Internet-facing hosts at the network perimeter prevents the hidden listener from ever being triggered.
• Cross-reference local reporting with network sensors, packet captures, and EDR/ETW telemetry to expose processes and connections hidden by RawWNPF.

Threat Hunting and Remediation (Detection as Reinforcement)

With the above preventive controls in place, use the following IOCs to proactively hunt for the threat and confirm whether remediation is complete:

• Scheduled task: ApphostRagistreationVerifier.
• IFEO: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File ExecutionOptions\vds.exe\debugger pointing to a binary under %SystemRoot%\Fonts\.
• Printprocessor: HKLM\SYSTEM\...\Print Processors\VSPMsg and C:\Windows\System32\spool\prtprocs\x64\VSPMsg.dll.
• Kernel artifacts: fsdiskbit.sys, the service registry key msi disk server, the device object \Device\RawWNPF (forensic tools with rootkit-detection capability are required; do not rely solely on user-mode tools).
• Firewall: a rule named Core Networking - Packet Too Big (ICMPv6 - In) that has been deleted and recreated with altered behavior.
• Files: tpsvcloc.dll, X1B5206BDC1743DD.dat, KX1B5206BDC1743DD.dat, KW1B5206BDC1743FP.dat, config.dat, affair-build.bat, klelam00007.bat, and TH-prefixed files in %TEMP%.

‍

IoCs (Indicators of Compromise)

Network IoC Analysis

This IP is the hardcoded C2 for the WIN_PLUS variant (TCP/443, UDP/53, WebSocket/80). Enrichment shows it is a cloud VPS leased from Vultr (The Constant Company, AS20473), located in Singapore, with hostname 207.148.78.36.vultrusercontent.com, consistent with FishMonger's typical pattern of using disposable cloud infrastructure for rapid deployment and abandonment.

On VirusTotal, 14 engines flag it as malicious, clearly confirming its malicious nature. However, Shodan (last updated July 10, 2026) detects only port 22/SSH open; the three C2 ports mentioned in the original report (443/53/80) are all currently closed, suggesting this C2 went offline or stopped listening after exposure, with the remaining SSH service likely being an administrative remnant.

Hash

IP

‍

Reference

• FishMonger’s arsenal upgraded: SprySOCKS for Windows
• 中國駭客 Earth Lusca 打造惡意軟體 SprySOCKS 變種，於政府機關從事攻擊活動
• ESET Research: China-aligned FishMonger updates its arsenal, targets governments in Asia and Latin America
• Linux Threat Report: Earth Lusca Deploys Novel SprySOCKS Backdoorin Attacks on Government Entities

‍