China-Linked SprySOCKS Backdoor Expands to Windows with Driver-Based Stealth

Cybersecurity researchers have uncovered a concerning evolution in the threat landscape with the discovery of Windows variants of the SprySOCKS backdoor, previously believed to be limited to Linux systems. This development indicates that China-linked threat actors are expanding their capabilities and adapting their tools to target a broader range of platforms, potentially increasing the number of organizations at risk of compromise.

The newly identified Windows variants, internally designated as WIN_DRV and WIN_PLUS, demonstrate significant sophistication in their approach to maintaining persistence and evading detection. According to research from ESET, both variants incorporate hardcoded command-and-control configurations, allowing threat actors to establish direct communication channels with compromised systems. These backdoors facilitate communication over both TCP and UDP protocols, providing multiple avenues for data exfiltration and remote control that can bypass simple network security measures.

The expansion of