SprySOCKS Windows Variant Abuses Kernel Drivers to Evade Detection

Security researchers have identified a dangerous evolution in the malware landscape with the emergence of a Windows variant of the SprySOCKS backdoor, demonstrating advanced evasion techniques through kernel driver abuse. This sophisticated threat represents a significant escalation in attacker capabilities, particularly as it has been deployed by a China-linked threat group against government targets across multiple nations.

The FishMonger threat group, associated with Chinese cyber operations, has developed an undocumented Windows version of what was previously a Linux-specific backdoor. This malware variant specifically targets kernel-level drivers to manipulate system operations and avoid detection by traditional security solutions. By operating at the kernel level, the malware gains deep system access and can effectively hide its malicious activities from most endpoint detection and response systems. The campaign has primarily focused on government entities in Honduras, Taiwan