A sophisticated new chapter in state-sponsored cyber espionage has just been written — and if your organisation runs Windows, it's one you need to read carefully. Security researchers at ESET have uncovered something that the cybersecurity community did not previously believe existed: a Windows variant of the SprySOCKS backdoor malware. Worse still, this variant doesn't just run quietly in the background — it weaponises Windows kernel drivers to become practically invisible to conventional security tools. Here's everything you need to know, and more importantly, what you can do about it.

What Is SprySOCKS — and Why Does the Windows Variant Matter?

SprySOCKS first appeared on researchers' radar in 2023 as a Linux-specific backdoor.

With its origins traced to the Trochilus open-source Windows malware, SprySOCKS showcases an alarming fusion of functionalities from different malware strains.

At the time,

the Linux version was used in attacks targeting government agencies involved in foreign affairs, technology, and telecommunications worldwide.

Fast forward to 2025, and ESET researchers have now confirmed what nobody expected.

ESET researchers have discovered two as-yet undocumented Windows variants of SprySOCKS, a previously Linux-only backdoor reportedly used by FishMonger, the group believed to be operated by a Chinese contractor named I‑SOON.

This discovery fundamentally changes the threat landscape.

The variants retain the core architecture of their Linux predecessor but adopt Windows-native mechanisms for cross-platform functionality and introduce additional evasion techniques.

Who Is Behind SprySOCKS? Meet FishMonger and I-SOON

To fully understand the threat, you need to understand the actors behind it.

FishMonger, also referred to as Earth Lusca, TAG-22, Aquatic Panda, or Red Dev 10, has a history of cyber-espionage dating back to at least 2019, and operates under the Winnti Group umbrella, primarily functioning out of Chengdu, China.

FishMonger is believed to be operated by a private hacking contractor, iSoon from Chengdu, China, to carry out long-term intelligence gathering and data theft.

This isn't merely a criminal enterprise — it's a state-adjacent operation.

On March 5, 2025, the DOJ unsealed an indictment against I-SOON employees and China's Ministry of Public Security officers, charging them with conducting cyber-espionage between 2016 and 2023.

The FBI also added several individuals associated with I-SOON to its "most wanted" list.

FishMonger's toolset includes ShadowPad, Spyder, Cobalt Strike, FunnySwitch, SprySOCKS, and the BIOPASS RAT

— a formidable arsenal that signals this group is not operating ad hoc. They are methodical, well-resourced, and persistent.

The Two Windows Variants: WIN_DRV and WIN_PLUS

The Windows variants discovered are internally marked as WIN_DRV and WIN_PLUS. Both come with a hardcoded C&C configuration and support communication over TCP, UDP, and WebSocket protocols.

Both variants support the same command set: collecting system information, launching an interactive shell, enumerating running processes, listing services, initializing a SOCKS proxy, uploading and downloading files, and executing files already on the system.

The backdoor can also log keystrokes and clipboard contents when switched on, and quietly adds a Windows firewall rule to let its traffic through.

The key differentiator is WIN_DRV.

Unlike the previously documented Linux version, the Windows variant adds kernel-level stealth capabilities allowing operators to hide malware artifacts and communicate with the backdoor through traffic redirected from arbitrary TCP ports.

WIN_PLUS, conversely, exploits the Windows Print Spooler service to load the backdoor.

Persistence is achieved via scheduled tasks and Image File Execution Options (IFEO) via vds.exe for WIN_DRV, and registering the payload as a Windows Print Processor (VSPMsg) for WIN_PLUS.

How the Kernel Driver Evasion Works

This is the most technically alarming aspect of the discovery — and the element that sets this malware variant apart from most threats your security team is prepared to face.

WIN_DRV uses two encrypted kernel drivers, the first of which is fsdiskbit.sys — or, as ESET researchers call it, "DriverLoader." The aptly named driver is delivered via the SprySOCKS loader and serves a single purpose: to load the second kernel driver, named "RawWNPF," directly into the memory of the target system.

The RawWNPF driver in turn hides the backdoor's malicious activity and can be configured through the driver's custom I/O control codes (IOCTLs). Because such drivers have privileged access to the Windows kernel, they can be used to kill security processes or, in the case of SprySOCKS, conceal malware's processes and files by intercepting certain system calls and modifying the output.

For example, RawWNPF hides processes by hooking the execution of the NtQuerySystemInformation Windows system call. "If any of the processes retrieved by this API function match a process from the driver's list of hidden processes, the driver removes this process from the function's output," ESET researchers wrote.

The result?

The driver enables the malware to hide processes via Windows API manipulation, hide network connections, hide files from directory listings, and hide malicious Registry key entries it uses for persistence.

From your security tooling's perspective, SprySOCKS simply doesn't exist.

Notably, the driver is loaded from another kernel driver named 'DriverLoader' signed using a leaked certificate from the GitHub PastDSE project

— a technique that exploits the trust Windows places in digitally signed drivers.

There's also a possible UEFI dimension to this threat.

ESET's telemetry suggests that some attacks may have involved a Unified Extensible Firmware Interface bootkit, indicating the threat actor could be exploiting CVE-2023-24932, a secure boot bypass vulnerability in Windows Boot Manager. The flaw allows attackers to execute untrusted software during the boot process at the firmware level, undermining Secure Boot's protections.

Who Are the Targets?

According to an ESET report, the Windows variant had been deployed primarily against government organisations in Honduras, Taiwan, Thailand, and Pakistan.

However, the group's ambitions stretch far wider.

FishMonger's previous targets include organisations in Taiwan, Hungary, Turkey, Thailand, France, and the US, documented in ESET's March 2025 report on Operation FishMedley.

The campaign predominantly targeted governments, NGOs, and think tanks, focusing on organisations that had significant geopolitical and economic interests.

The initial access vector remains undetermined, though past exploits of vulnerabilities in Fortinet, GitLab, and Microsoft Exchange have been noted

— a reminder that perimeter vulnerabilities remain the door through which many sophisticated attacks begin.

Practical Tips: How to Defend Against Kernel-Level Malware Like SprySOCKS

The kernel-level nature of this threat means conventional antivirus alone is insufficient. Here's what security teams should action immediately:

If possible, turn on VBS and HVCI through Group Policy (Enable virtualization-based protection of code integrity)

— this prevents unauthorised kernel code from executing, even if a driver is loaded.

Apply Microsoft's driver blocklist (Microsoft recommended driver block rules) and never install unnecessary drivers or drivers from unknown sources.

Never disable PatchGuard (KPP) and never disable Driver Signing Enforcement

— both are key defences against unauthorised kernel-mode code.

One important step in the fight against zero-day rootkits is to ensure that users log on with a standard user account. Most kernel-mode rootkits will simply fail to install when the user is not logged on with an administrator account.

Install an EDR on the organisation's machines to mitigate and detect anomalous behaviour.

Ensure your EDR has kernel-level telemetry and is not solely reliant on user-mode hooking.

Ensure that all systems, including operating systems, applications, and network devices, are regularly patched to protect against known vulnerabilities exploited by threat actors like FishMonger.

Scrutinise scheduled tasks and Image File Execution Options (IFEO) entries as indicators of compromise.

Watch for features that allow inspecting incoming TCP traffic and redirecting specially crafted packets to the SprySOCKS backdoor, enabling communication without exposing the listening port.

Conclusion: The Threat Is Real, and Preparation Cannot Wait

The discovery of a Windows variant of SprySOCKS is not an incremental threat update — it's a seismic shift in the capabilities of one of the most active state-linked APT groups operating today.

In addition to porting SprySOCKS to Windows, FishMonger actors added new functionality using malicious kernel drivers that allow the backdoor to remain undetected. The newly discovered variant shows how extensive the advanced persistent threat's arsenal is, and once again demonstrates the danger posed by kernel drivers to enterprise security.

Government agencies and enterprises with any connection to geopolitically sensitive data must treat this as a priority concern — not a theoretical one. The combination of kernel-level rootkit stealth, over 30 C&C commands, potential UEFI bootkit deployment, and state-backed resources makes SprySOCKS a threat of the highest order.

Don't wait for a breach to validate your defences. Conduct a kernel driver audit on your Windows estate today, review your EDR coverage for kernel-level visibility, and ensure your patch management strategy addresses known vulnerabilities in Fortinet, GitLab, Microsoft Exchange, and Windows Boot Manager. If you're unsure where your gaps are, now is the time to engage a professional threat assessment before FishMonger finds them first.