For years, SprySOCKS was treated as a Linux problem. Security teams defending Windows infrastructure had little reason to add it to their watchlists. That assumption is now obsolete. Researchers have uncovered two fully operational Windows variants of the backdoor, deployed by the China-linked threat actor FishMonger against government targets across Asia and Latin America — and the technical sophistication on display signals a deliberate, long-term investment in cross-platform espionage capability.
From Linux Niche to Windows Battleground
SprySOCKS first entered the threat intelligence record in late 2023, documented exclusively as a Linux backdoor and attributed to a Chinese state-affiliated contractor operating under multiple tracking aliases — among them Earth Lusca, Charcoal Typhoon, Aquatic Panda, and RedHotel. The group, which security researchers at ESET cluster under the label FishMonger and place within the broader Winnti constellation, has been active since at least 2021 and carries a well-documented history of targeting government and research institutions across Europe, Asia, and North America.
The newly identified Windows variants, designated internally as WIN_DRV and WIN_PLUS, represent version 1.8 of the SprySOCKS codebase. Both retain the core architecture of the Linux original — the same command-and-control protocol structure, the same encryption scheme, the same command handling logic — but they arrive wrapped in Windows-native stealth mechanisms that substantially raise the difficulty of detection.
WIN_DRV: Kernel-Level Concealment and Traffic Diversion
Of the two variants, WIN_DRV is the more technically aggressive. At its core sits a kernel driver called RawWNPF, stored on disk under an inconspicuous filename designed to avoid casual scrutiny. A second encrypted kernel component — DriverLoader — handles the loading of RawWNPF, creating a layered protection architecture that operates entirely below the visibility horizon of standard user-mode security tools.
Once active, RawWNPF hides the backdoor's network connections, running processes, files, and registry artifacts from any monitoring tool that operates at the application layer. This is not obfuscation — it is active concealment enforced at the kernel level, rendering conventional endpoint detection considerably less reliable.
WIN_DRV creates a stealthy passive TCP backdoor, relying on a kernel driver to redirect traffic to the backdoor's hidden TCP port whenever specially crafted data is detected inside a received TCP packet.
The delivery chain is deliberately convoluted: an undetermined initial access method drops a batch script, which establishes a scheduled task, which triggers a DLL side-loading sequence that installs both the backdoor and its driver stack. Each added layer is a friction point for incident responders attempting to reconstruct the intrusion.
The TCP traffic diversion mechanism deserves particular attention. The backdoor listens on a randomized port, with the kernel driver routing specially crafted packets to that port invisibly. Network-based detection — one of the most reliable fallback controls when endpoint tools fail — is significantly degraded as a result.
WIN_PLUS: Blending Into Windows Baseline Noise
WIN_PLUS takes a more surgical approach to concealment. Rather than deploying kernel drivers, it exploits the inherent trust that Windows environments place in certain system processes. The variant launches as a print processor within spoolsv.exe — the Windows Print Spooler service — and subsequently injects a SprySOCKS loader into a newly spawned svchost.exe process.
Both spoolsv.exe and svchost.exe are ubiquitous in any Windows environment. They generate constant baseline activity, and their presence rarely triggers alerts on its own. By anchoring malicious execution to these processes, WIN_PLUS achieves a form of camouflage that is particularly effective against behavioral detection rules tuned to flag anomalous process trees. The variant was first observed in July 2024 on a compromised device in Pakistan.
Targets, Tradecraft, and a UEFI-Level Wild Card
Evidence indicates the Windows variants were deployed between 2023 and 2024 against government organizations in Honduras, Taiwan, Thailand, and Pakistan — a target set consistent with FishMonger's established pattern of geopolitical intelligence collection. The group's previous confirmed operations, including the documented Operation FishMedley campaign, implicated targets in Taiwan, Hungary, Turkey, France, and the United States.
Both variants support an identical command set: system reconnaissance, interactive shell access, process and service enumeration, SOCKS proxy initialization, and bidirectional file transfer. This functional parity with the Linux version confirms that the Windows port is not an experimental prototype — it is a production-ready tool.
Perhaps the most consequential detail in the researchers' findings is a peripheral one: limited forensic indicators suggesting possible use of a UEFI bootkit, potentially leveraging CVE-2023-24932, the Windows Boot Manager vulnerability previously exploited by the BlackLotus bootkit. Microsoft issued a patch in May 2023, but exploitation of this flaw at the firmware level would grant persistence that survives complete operating system reinstallation — a capability that fundamentally changes incident response calculus. Whether this indicator is confirmed or circumstantial has not yet been established, but its presence in the research warrants serious attention.
Attribution Complexity and Shared Codebases
SprySOCKS traces its lineage to Trochilus, a Windows remote access tool that also forms the foundation of RedLeaves, another backdoor with substantial code overlap. A third cluster, Webworm, shares tradecraft with both FishMonger and a group called SixLittleMonkeys, and also draws on the Trochilus codebase. When multiple state-affiliated actors pull from shared tooling repositories, clean attribution becomes genuinely difficult — which may itself be a feature of the arrangement rather than an accident.
What You Should Do
FishMonger's expansion of SprySOCKS into Windows territory is not a surprise — it is an inevitability that followed a predictable strategic logic. What matters now is whether defenders update their assumptions as quickly as the adversary updated its toolkit.
