Windows variants for the SprySOCKS Linux malware have been used in attacks targeting government organizations in at least four countries.
SprySOCKS has been linked to the Chinese threat group ‘Earth Lusca,’ which deployed it in attacks against government entities focused on foreign affairs, technology, and telecommunications.
Now, ESET researchers discovered Windows variants of the same malware family that were used between 2023 and 2024 in attacks on government organizations in Taiwan, Thailand, Pakistan, and Honduras.
ESET attributes the activity with high confidence to the Earth Lusca threat actor, which they track as ‘FishMonger’ (also ‘Aquatic Panda,’ ‘Red Dev 10,’ and TAG-22).
Unlike the previously documented Linux version, the Windows variant adds kernel-level stealth capabilities allowing operators to hide malware artifacts and communicate with the backdoor through traffic redirected from arbitrary TCP ports
The two variants are WIN_DRV, which features kernel drivers for rootkit-like capabilities, and WIN_PLUS, a more barebones backdoor.
Both variants offer the following capabilities:
Communicate over TCP, UDP, and WebSocket
Support more than 30 command-and-control (C2) commands
Collect system information
Enumerate and manage processes and services
List, create, delete, upload, download, copy, rename, and execute files
Support SOCKS proxy functionality
Can operate as both a client and a server
Log keystrokes, clipboard content, and active window titles
The WIN_PLUS variant execution flow Source: ESET
The WIN_DRV variant includes the additional functionality of loading a driver named ‘RawWNPF’ directly into memory.
The driver is loaded from another kernel driver named ‘DriverLoader’ (fsdiskbit.sys) signed using a leaked certificate from the GitHub PastDSE project.
The driver enables the malware to hide processes via Windows API manipulation, hide network connections, hide files from directory listings, and hide malicious Registry key entries it uses for persistence.
Persistence is achieved via scheduled tasks and Image File Execution Options (IFEO) via vds.exe for WIN_DRV, and registering the payload as a Windows Print Processor (VSPMsg) for WIN_PLUS.
Another observed feature allows inspecting incoming TCP traffic and redirecting specially crafted packets to the SprySOCKS backdoor. This enable communication without exposing the listening port.
“The WIN_DRV version […] enables TCP traffic diversion allowing the malware operators to send commands to the backdoor through a random TCP port on the victim’s device without exposing the backdoor's real listening port in the network traffic,” ESET explains.
The WIN_DRV execution flow Source: ESET
ESET telemetry data also showed indications of a UEFI bootkit component that might exploit CVE-2023-24932, a Secure Boot flaw previously used as a zero-day by the BlackLotus UEFI malware.
However, no further details or strong evidence were provided to support a link to BlackLotus.
ESETS report provides a detailed technical analysis and indicators of compromise that could help organizations identify and protect against attacks using Windows versions of the SprySOCKS backdoor.
Although these variants are not new, their diacovery indicates that Earth Lusca has expanded its arsenal to target a more riverse variety of systems.
Post a Comment Community Rules
You need to login in order to post a comment
Not a member yet? Register Now
<small>Source: Bleeping Computer</small>
