FishMonger (I-SOON / Winnti) Ports SprySOCKS Backdoor to Windows — WIN_DRV (RawWNPF Kernel Rootkit) & WIN_PLUS Variants
FishMonger (I-SOON / Winnti) Ports SprySOCKS Backdoor to (TL-2026-0884), also tracked as SprySOCKS for Windows, is a high-severity malware campaign, first published 2026-06-20 and last reviewed 2026-08-29. It is attributed to Earth Lusca (China) with high confidence, affects Microsoft Windows (x64), references 1 CVE (CVE-2023-24932), maps to 39 MITRE ATT&CK techniques (T1007, T1008, T1010), and is covered by 9 detection rules and 30 indicators of compromise.
Key facts for TL-2026-0884
- Threat ID
- TL-2026-0884
- Also known as
- SprySOCKS for Windows, WIN_DRV, WIN_PLUS
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-06-20
- Last reviewed
- 2026-08-29
- Attribution
- Earth Lusca
- Attribution confidence
- HIGH
- Nation-state nexus
- China
- Motivation
- ESPIONAGE
- Target sectors
- government
- Target regions
- Honduras, Taiwan, Thailand, Pakistan, Central America, Asia
- Detection rules
- 9
- Indicators of compromise
- 30
- Updates
- 2026-08-29 · revalidated 1× · latest source
Malware and tooling in FishMonger (I-SOON / Winnti) Ports SprySOCKS Backdoor to
Malware and tooling: PastDSE leaked code-signing certificate, RawWNPF
ESET attributes two previously undocumented Windows variants of the SprySOCKS backdoor — WIN_DRV and WIN_PLUS — to the China-nexus FishMonger group (operated by contractor I-SOON, under the Winnti umbrella). WIN_DRV installs the RawWNPF kernel-mode rootkit, signed with a leaked PastDSE code-signing certificate, that strips the backdoor's connections, processes, files and registry keys from system output via Windows Filtering Platform hooks. The backdoors implement 30+ AES-128-encrypted C2 commands and have targeted government entities in Honduras, Taiwan, Thailand and Pakistan during 2023–2024.
How FishMonger (I-SOON / Winnti) Ports SprySOCKS Backdoor to works
In June 2026 ESET Research published analysis of two as-yet-undocumented Windows ports of SprySOCKS, a backdoor previously documented only on Linux (Trend Micro, September 2023). The variants are internally tagged WIN_DRV and WIN_PLUS and are attributed to FishMonger — a China-nexus intrusion set widely assessed to be operated by the contractor I-SOON (Anxun) and grouped under the Winnti umbrella (overlaps reported with Earth Lusca, TAG-22, Aquatic Panda and Red Dev 10). ESET telemetry shows victims, mostly government organizations, in Honduras, Taiwan, Thailand and Pakistan between 2023 and 2024; samples were uploaded to VirusTotal from April 2024 (archive klelam00007.zip), and Chinese-language debug paths suggest development began as early as April 2023.
WIN_PLUS is the lighter build. A first-stage print-processor-style loader (VSPMsg.dll) decrypts an AES-128-ECB encrypted container (config.dat) stored under the spool color directory using the hardcoded key 'uXQLESMXGaRMs6BL', then injects the real backdoor into svchost.exe via a process-doppelgänging-style technique. Persistence is achieved by registering a custom print processor (HKLM\SYSTEM\ControlSet001\Control\Print\Environments\Windows x64\Print Processors\VSPMsg). Its hardcoded C2 is 207.148.78[.]36 over TCP/443, UDP/53 and WebSocket/80.
WIN_DRV is the more sophisticated variant. Its loader chain abuses DLL side-loading via the legitimate ThinPrint AutoConnect binary ApphostRagistreationVerifier.exe (loading malicious tpsvcloc.dll alongside the genuine tpsvc.dll) and a scheduled task of the same name running as NT AUTHORITY\SYSTEM. It drops three encrypted containers into %SystemRoot%\Fonts\ and installs two kernel-mode components: a signed DriverLoader (bthcam.sys / fsdiskbit.sys) that memory-maps and launches an in-memory driver, and RawWNPF, a WFP/minifilter-based rootkit. RawWNPF intercepts Windows Filtering Platform calls so that even netstat.exe will not reveal the backdoor's connections, and exposes IOCTLs to hide TCP connections (0x220200/0x220300 family) and processes (0x220350 family). The DriverLoader is signed with a code-signing certificate leaked from the PastDSE project on GitHub to satisfy Windows driver-signing enforcement. Persistence also uses Image File Execution Options debugger hijacking of vds.exe.
Both variants support over 30 C2 commands spanning system enumeration, process/service control, SOCKS proxying, file management, a cmd.exe remote shell, clipboard capture and keylogging (keystrokes saved to %appdata%\Microsoft\Vault\lg.dat using single-byte XOR key 0x44, configured via lgf.dat). C2 messages are AES-128 encrypted with the key 'QFTHEYjzX3RBOMgZ' and framed with protocol magic values (TCP 0xACACBCBC, UDP 0xACACBFBC, WebSocket 0x1BDCCBAA). Traffic-signaling/socket-filter logic lets operators reach the implant over any open TCP port. ESET notes limited indications that some SprySOCKS scenarios may involve a UEFI bootkit component, possibly abusing CVE-2023-24932 (Secure Boot Security Feature Bypass, the BlackLotus-class flaw), which could allow the malware to survive a full OS reinstall. FishMonger's broader arsenal includes ShadowPad, Spyder, Cobalt Strike, FunnySwitch and BIOPASS RAT.
MITRE ATT&CK techniques used in TL-2026-0884
Discovery
T1007 System Service Discovery; T1010 Application Window Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery; T1124 System Time Discovery; T1518 Software Discovery; T1614 System Location Discovery
Command and Control
T1008 Fallback Channels; T1090 Proxy; T1095 Non-Application Layer Protocol; T1132 Data Encoding; T1571 Non-Standard Port; T1573 Encrypted Channel; T1665 Hide Infrastructure
Defense Evasion
T1014 Rootkit; T1027 Obfuscated Files or Information; T1055 Process Injection; T1070 Indicator Removal; T1140 Deobfuscate/Decode Files or Information; T1205 Traffic Signaling; T1497 Virtualization/Sandbox Evasion; T1574 Hijack Execution Flow; T1622 Debugger Evasion
Exfiltration
T1041 Exfiltration Over C2 Channel
Persistence
T1053 Scheduled Task/Job; T1542.003 Pre-OS Boot; T1546 Event Triggered Execution; T1547 Boot or Logon Autostart Execution
Collection
T1056 Input Capture; T1115 Clipboard Data
Execution
T1059 Command and Scripting Interpreter; T1106 Native API; T1569 System Services
Privilege Escalation
T1134 Access Token Manipulation
Initial Access
T1190 Exploit Public-Facing Application
Resource Development
Reconnaissance
T1590 Gather Victim Network Information; T1592 Gather Victim Host Information
defense-impairment
Affected products and versions in FishMonger (I-SOON / Winnti) Ports SprySOCKS Backdoor to
- Microsoft — Windows (x64)
Vulnerable versions: Windows 10; Windows 11; Windows Server 2016-2025 - Microsoft — Windows Secure Boot (UEFI) — CVE-2023-24932
Vulnerable versions: Windows 10 1507-22H2; Windows 11 21H2-24H2; Windows Server 2008-2025
Fixed in: Systems with KB5025885 mitigations applied
Remediation for FishMonger (I-SOON / Winnti) Ports SprySOCKS Backdoor to
Patches
- Apply Microsoft's CVE-2023-24932 mitigation guidance (KB5025885) and revoke vulnerable boot managers via the staged DB/DBX updates
Immediate actions
- Block C2 207.148.78.36 and delivery host 207.148.75.122; scope the Vultr 207.148.64.0/20 range at the perimeter
- Hunt for the listed SHA-1 hashes and for unexpected DLLs in %SystemRoot%\Fonts\ (tpsvc.dll, tpsvcloc.dll, ApphostRagistreationVerifier.exe, X1B5206BDC1743DD.dat)
- Audit print-processor registry entries (Print Processors\VSPMsg) and Image File Execution Options debugger values (vds.exe)
- Inspect for the scheduled task 'ApphostRagistreationVerifier' running as SYSTEM and the service 'msidiskserver'
Workarounds
- Enable Microsoft Vulnerable Driver Blocklist / HVCI to reduce abuse of leaked signing certificates
- Restrict the spooler / print-processor registration paths and remove the Print Spooler service where not required
Longer-term hardening
- Deploy EDR with kernel-driver and behavioral (process-doppelgänging, DLL side-loading) detection
- Enforce Microsoft vulnerable/revoked driver blocklist and Attack Surface Reduction rules
- Monitor Windows Filtering Platform callout driver loads and unexpected minifilter registrations
CVEs associated with FishMonger (I-SOON / Winnti) Ports SprySOCKS Backdoor to
CVE-2023-24932
Weaknesses (CWE) in FishMonger (I-SOON / Winnti) Ports SprySOCKS Backdoor to
CWE-863
Timeline of FishMonger (I-SOON / Winnti) Ports SprySOCKS Backdoor to
- FishMonger's prior Operation FishMedley compromised seven government, NGO and think-tank organizations across Asia, Europe and the US using ShadowPad, Spyder, SodaMaster, Cobalt Strike, FunnySwitch and BIOPASS RAT, establishing the tradecraft baseline the Windows SprySOCKS port extends.
- Chinese-language debug paths in samples indicate the Windows SprySOCKS project was underway as early as April 2023.
- Microsoft patches CVE-2023-24932, the Secure Boot bypass abused by the BlackLotus bootkit; the same flaw is leveraged by FishMonger's UEFI bootkit component to survive OS reinstalls before mitigations are fully enforced.
- Delivery server 207.148.75[.]122 (Vultr 207.148.64.0/20) observed in a June 2023 campaign in the same subnet as the C2.
- Trend Micro publishes the first documentation of the Linux SprySOCKS backdoor, attributed to Earth Lusca.
- ESET telemetry begins recording WIN_DRV/WIN_PLUS victims (government entities in Honduras, Taiwan, Thailand, Pakistan) across 2023-2024.
- The I-SOON (Anxun) document leak on GitHub exposes the Chinese contractor's tooling and links to the Winnti/FishMonger cluster, corroborating the attribution behind the SprySOCKS campaign.
- Samples uploaded to VirusTotal under the archive name klelam00007.zip from April 2024 onward.
- WIN_PLUS variant first detected in telemetry from a Pakistani government target.
- Observed FishMonger SprySOCKS-for-Windows activity continues through 2024 per ESET telemetry.
- US DOJ unseals an indictment against I-SOON employees and Chinese Ministry of Public Security officers for espionage operations spanning 2016-2023, independently corroborating ESET's attribution of FishMonger to I-SOON.
- ESET Research (WeLiveSecurity) publishes the FishMonger SprySOCKS-for-Windows report; covered by The Hacker News, Security Affairs, GBHackers and others.
Update history for TL-2026-0884
- 2026-08-29 — FishMonger (Earth Lusca) Ships Windows SprySOCKS Backdoor with Kernel Driver Stealth Module: What changed No severity, exploitability, status or attribution-confidence escalation — all remain HIGH/ACTIVE/ACTIVE/HIGH as already recorded. The update fills gaps and adds corroborating context rather than escalating the threat. New indi
Sources cited for FishMonger (I-SOON / Winnti) Ports SprySOCKS Backdoor to
- FishMonger's arsenal upgraded: SprySOCKS for Windows
- FishMonger Hackers Expands SprySOCKS Backdoor From Linux to Windows
- China-Linked SprySOCKS Backdoor Expands to Windows with Driver-Based Stealth
- China-Linked FishMonger Ports SprySOCKS to Windows With Kernel-Level Stealth and UEFI Bootkit Hints
- SprySOCKS Windows Backdoor Uses Kernel Driver to Hide Processes, Files, and Network Traffic
- SprySOCKS Backdoor Expands From Linux to Windows
- CVE-2023-24932 — Secure Boot Security Feature Bypass Vulnerability (NVD)
- Trend Micro — Earth Lusca / SprySOCKS Linux backdoor (original documentation)
Threats related to FishMonger (I-SOON / Winnti) Ports SprySOCKS Backdoor to
- Daxin Returns: China-Linked Kernel Rootkit Resurfaces in Taiwan Alongside New Stupig Backdoor
- Operation DragonReturn — China-Nexus DcRAT Multi-Stage Espionage Campaign Targeting Govt. of India Ministry of Finance / Income Tax Infrastructure
- Daxin Rootkit Resurfaces After 13 Years: China-Linked Kernel Backdoor Found Alongside New Pre-Auth 'Stupig' DLL on Taiwan Manufacturer's Network
- SharkLoader Malware Campaign Uses Fake Cisco AnyConnect and Google Update Installers to Deploy Cobalt Strike
Detection coverage for TL-2026-0884
As of 2026-08-29, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0884 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.