# FishMonger (I-SOON / Winnti) Ports SprySOCKS Backdoor to Windows — WIN_DRV (RawWNPF Kernel Rootkit) & WIN_PLUS Variants

> ESET attributes two previously undocumented Windows variants of the SprySOCKS backdoor — WIN_DRV and WIN_PLUS — to the China-nexus FishMonger group (operated by contractor I-SOON, under the Winnti umbrella). WIN_DRV installs the RawWNPF kernel-mode rootkit, signed with a leaked PastDSE code-signing certificate, that strips the backdoor's connections, processes, files and registry keys from system output via Windows Filtering Platform hooks. The backdoors implement 30+ AES-128-encrypted C2 commands and have targeted government entities in Honduras, Taiwan, Thailand and Pakistan during 2023–2024.

- **Published:** 2026-06-20T00:00:00Z
- **Last reviewed:** 2026-08-29T17:55:23.137Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0884
- **ID:** TL-2026-0884
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Earth Lusca (China)
- **Detections:** 9 · **IOCs:** 30 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2023-24932

## Description

In June 2026 ESET Research published analysis of two as-yet-undocumented Windows ports of SprySOCKS, a backdoor previously documented only on Linux (Trend Micro, September 2023). The variants are internally tagged WIN_DRV and WIN_PLUS and are attributed to FishMonger — a China-nexus intrusion set widely assessed to be operated by the contractor I-SOON (Anxun) and grouped under the Winnti umbrella (overlaps reported with Earth Lusca, TAG-22, Aquatic Panda and Red Dev 10). ESET telemetry shows victims, mostly government organizations, in Honduras, Taiwan, Thailand and Pakistan between 2023 and 2024; samples were uploaded to VirusTotal from April 2024 (archive klelam00007.zip), and Chinese-language debug paths suggest development began as early as April 2023.

WIN_PLUS is the lighter build. A first-stage print-processor-style loader (VSPMsg.dll) decrypts an AES-128-ECB encrypted container (config.dat) stored under the spool color directory using the hardcoded key 'uXQLESMXGaRMs6BL', then injects the real backdoor into svchost.exe via a process-doppelgänging-style technique. Persistence is achieved by registering a custom print processor (HKLM\SYSTEM\ControlSet001\Control\Print\Environments\Windows x64\Print Processors\VSPMsg). Its hardcoded C2 is 207.148.78[.]36 over TCP/443, UDP/53 and WebSocket/80.

WIN_DRV is the more sophisticated variant. Its loader chain abuses DLL side-loading via the legitimate ThinPrint AutoConnect binary ApphostRagistreationVerifier.exe (loading malicious tpsvcloc.dll alongside the genuine tpsvc.dll) and a scheduled task of the same name running as NT AUTHORITY\SYSTEM. It drops three encrypted containers into %SystemRoot%\Fonts\ and installs two kernel-mode components: a signed DriverLoader (bthcam.sys / fsdiskbit.sys) that memory-maps and launches an in-memory driver, and RawWNPF, a WFP/minifilter-based rootkit. RawWNPF intercepts Windows Filtering Platform calls so that even netstat.exe will not reveal the backdoor's connections, and exposes IOCTLs to hide TCP connections (0x220200/0x220300 family) and processes (0x220350 family). The DriverLoader is signed with a code-signing certificate leaked from the PastDSE project on GitHub to satisfy Windows driver-signing enforcement. Persistence also uses Image File Execution Options debugger hijacking of vds.exe.

Both variants support over 30 C2 commands spanning system enumeration, process/service control, SOCKS proxying, file management, a cmd.exe remote shell, clipboard capture and keylogging (keystrokes saved to %appdata%\Microsoft\Vault\lg.dat using single-byte XOR key 0x44, configured via lgf.dat). C2 messages are AES-128 encrypted with the key 'QFTHEYjzX3RBOMgZ' and framed with protocol magic values (TCP 0xACACBCBC, UDP 0xACACBFBC, WebSocket 0x1BDCCBAA). Traffic-signaling/socket-filter logic lets operators reach the implant over any open TCP port. ESET notes limited indications that some SprySOCKS scenarios may involve a UEFI bootkit component, possibly abusing CVE-2023-24932 (Secure Boot Security Feature Bypass, the BlackLotus-class flaw), which could allow the malware to survive a full OS reinstall. FishMonger's broader arsenal includes ShadowPad, Spyder, Cobalt Strike, FunnySwitch and BIOPASS RAT.

## MITRE ATT&CK

- T1592 Gather Victim Host Information
- T1590 Gather Victim Network Information
- T1587 Develop Capabilities
- T1059 Command and Scripting Interpreter
- T1569 System Services
- T1106 Native API
- T1053 Scheduled Task/Job
- T1547 Boot or Logon Autostart Execution
- T1546 Event Triggered Execution
- T1134 Access Token Manipulation
- T1205 Traffic Signaling
- T1622 Debugger Evasion
- T1140 Deobfuscate/Decode Files or Information
- T1070 Indicator Removal
- T1027 Obfuscated Files or Information
- T1055 Process Injection
- T1014 Rootkit
- T1497 Virtualization/Sandbox Evasion
- T1574 Hijack Execution Flow
- T1685 Disable or Modify Tools
- T1010 Application Window Discovery
- T1083 File and Directory Discovery
- T1518 Software Discovery
- T1082 System Information Discovery
- T1614 System Location Discovery
- T1007 System Service Discovery
- T1124 System Time Discovery
- T1056 Input Capture
- T1115 Clipboard Data
- T1132 Data Encoding
- T1573 Encrypted Channel
- T1008 Fallback Channels
- T1665 Hide Infrastructure
- T1571 Non-Standard Port
- T1095 Non-Application Layer Protocol
- T1041 Exfiltration Over C2 Channel
- T1190 Exploit Public-Facing Application
- T1542.003 Pre-OS Boot
- T1090 Proxy

## Sources

- [FishMonger's arsenal upgraded: SprySOCKS for Windows](https://www.welivesecurity.com/en/eset-research/fishmongers-arsenal-upgraded-sprysocks-windows/)
- [FishMonger Hackers Expands SprySOCKS Backdoor From Linux to Windows](https://cybersecuritynews.com/fishmonger-hackers-expands-sprysocks-backdoor-from-linux/)
- [China-Linked SprySOCKS Backdoor Expands to Windows with Driver-Based Stealth](https://thehackernews.com/2026/06/china-linked-sprysocks-backdoor-expands.html)
- [China-Linked FishMonger Ports SprySOCKS to Windows With Kernel-Level Stealth and UEFI Bootkit Hints](https://securityaffairs.com/193728/apt/china-linked-fishmonger-ports-sprysocks-to-windows-with-kernel-level-stealth-and-uefi-bootkit-hints.html)
- [SprySOCKS Windows Backdoor Uses Kernel Driver to Hide Processes, Files, and Network Traffic](https://gbhackers.com/sprysocks-windows-backdoor-uses-kernel/)
- [SprySOCKS Backdoor Expands From Linux to Windows](https://www.infosecurity-magazine.com/news/sprysocks-backdoor-windows/)
- [CVE-2023-24932 — Secure Boot Security Feature Bypass Vulnerability (NVD)](https://nvd.nist.gov/vuln/detail/CVE-2023-24932)
- [Trend Micro — Earth Lusca / SprySOCKS Linux backdoor (original documentation)](https://www.trendmicro.com/en_us/research/23/i/earth-lusca-employs-new-linux-backdoor.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0884