SprySOCKS Windows Backdoor Uses Kernel Driver to Hide Processes, Files, and Network Traffic

Windows variants of SprySOCKS, a backdoor long associated with FishMonger (aka Earth Lusca/TAG-22), expanding a toolset that was until now Linux-only.

The two Windows builds internally labelled WIN_DRV and WIN_PLUS preserve the original SprySOCKS protocol and command set while adding Windows-native loading techniques and, in WIN_DRV’s case, a kernel-mode driver that substantially increases stealth and persistence.

ESET telemetry links real-world activity to 2023–2024 and shows infections of mainly government targets in Honduras, Taiwan, Thailand, and Pakistan.

Both variants embed hardcoded C2 configuration and support TCP, UDP, and WebSocket channels. Their backdoor core implements over 30 commands: system reconnaissance, process and service management, file operations (list, create, delete, transfer), SOCKS proxy setup, and remote interactive shells.

Networking and low-level I/O reuse open-source components HP-Socket for networking and Crypto++ for cryptography and the C2 protocol follows the same multi-protocol header-and-AES-ECB-encrypted payload design observed in the previously reported Linux SprySOCKS samples.

According to ESET, researchers have discovered two as-yet undocumented Windows variants of SprySOCKS, a previously Linux-only backdoor reportedly used by FishMonger.

Keys, message magic values, and message framing show clear code lineage to the Linux variant reported earlier by Trend Micro.

WIN_PLUS is the lighter Windows build: it contains a first-stage print-processor-style loader that decrypts an encrypted container (AES-128-ECB, hardcoded key) stored under spool directories, injects the real backdoor into svchost via process-doppelgänging-like techniques, and establishes persistence by registering a custom print processor.

SprySOCKS Windows Backdoor Uses Kernel

The WIN_PLUS samples observed by ESET included an active C2 configuration that pointed to infrastructure in the 207.148.64.0/20 range (Vultr-hosted), using TCP:443, UDP:53, and WebSocket:80 matching FishMonger’s prior usage patterns.

WIN_DRV is the more sophisticated variant. Its loader uses DLL side‑loading and scheduled tasks to achieve SYSTEM execution, drops three encrypted containers, and installs two kernel-mode components: a signed DriverLoader that memory‑maps and launches an in-memory driver, and RawWNPF, a minifilter/WFP-based rootkit driver.

If no errors are detected, the loader deletes both the msidiskserver registry key and the fsdiskbit.sys file. After this, the loader is done and exits.

RawWNPF is the stealth engine: it hooks NtQuerySystemInformation to hide process entries, implements filesystem minifilter callbacks to hide files (including the deployed loader, DLLs, and encrypted containers), registers a registry callback to hide persistence keys, and installs WFP callouts to inspect and manipulate IPv4 packets.

Notably, RawWNPF can divert TCP packets: when specially crafted data is detected in inbound TCP payloads on any open port, the driver rewrites/redirects the flow to the backdoor’s hidden listening port.

Because the real listening port is never visible in standard tools (for example netstat), operators can reach the backdoor without exposing its true port in network captures an effective passive backdoor mechanism that complicates incident response and network attribution.

The WORD value 0x0003 (likely indicating the encryption method), followed by 128-bit AES-ECB mode encrypted data (using the hardcoded key QFTHEYjzX3RBOMgZ).

The driver also supports IOCTLs to manage hidden connections and hidden process lists, and the attackers used a leaked PastDSE certificate to sign a driver to bypass signature enforcement on some systems.

ESET’s analysis also flagged limited telemetry suggesting that some SprySOCKS campaigns may include a UEFI bootkit component (possible exploitation chain involving CVE‑2023‑24932), though confirmation is limited.

Taken together, the Windows port preserves SprySOCKS’ cross‑platform C2 and command semantics while adopting Windows-specific persistence, process injection, and kernel stealth primitives supporting ESET’s high‑confidence attribution to FishMonger (I‑SOON).

Defenders should hunt for indicators described in ESET’s write-up: suspicious DLL side‑loading of signed executables renamed to mimic Microsoft services, files under %SystemRoot%\Fonts and spool directories with AES-encrypted containers, unusual WFP callouts, hidden processes and hidden network entries, and outbound connections to 207.148.64.0/20.

IOCs

Files

SHA‑1	Filename	Detection	Description
955BFC3DCC867256F9F46A606DEB0779FA3416D8	KX1B5206BDC1743DD.dat	Win64/SprySOCKS.A	Encrypted SprySOCKS DriverLoader driver.
44DC4A08C5EB0972C8E18B0E01284E06F09006BB	bthcam.sys	Win64/Agent.ESB	SprySOCKS DriverLoader driver.
AB87B29B6F79487C75CA08D102E79001E536F083	KW1B5206BDC1743FP.dat	Win64/SprySOCKS.A	Encrypted SprySOCKS RawWNPF driver.
6490B8E4AADE25A3EE2DA9A47F312DB2122470BC	X1B5206BDC1743DD.dat	Win64/SprySOCKS.A	Encrypted container of the encrypted WIN_DRV variant of SprySOCKS backdoor, encrypted SprySOCKS RawWNPF and SprySOCKS DriverLoader drivers.
E7484C24B88A1A2407A8F09D734F9A993670285B	klelam00007.zip	Win64/Agent.CXZ Win64/SprySOCKS.A BAT/Runner.KS	ZIP archive from VirusTotal containing the WIN_DRV variant of SprySOCKS, along with all the backdoor’s components; clean binaries used for side-loading are included.
621D1952839BE4B0A1B0E66E87BCE5062CA368ED	tpsvcloc.dll	Win64/Agent.CXZ	SprySOCKS loader.
2457EED2AB28E37741F10914EF929DAD2C8079D4	VSPMsg.dll	Win64/Agent.CXZ	First-stage loader responsible for launching the SprySOCKS loader.
D2C706B1EAF662BF0CE124B5032F73ED84BDA24A	N/A	Win64/SprySOCKS.A	WIN_PLUS variant of the SprySOCKS backdoor.
5F3B87CEF56683D9A9E19186E0FD0D8019B559C4	N/A	Win64/Agent.CXZ	SprySOCKS loader.
C793CA31E3F6628B5C8986146953BF66232E9A30	config.dat	Win64/SprySOCKS.A	Encrypted container of the WIN_PLUS variant of the SprySOCKS backdoor and its loader.
037DB2445F3D72388CB2CF8510563148E5A184BE	N/A	BAT/Runner.KS	Batch script that persists the WIN_DRV variant of SprySOCKS.

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.