SprySOCKS for Windows: FishMonger’s Linux Backdoor Grows a Kernel Rootkit
China-aligned FishMonger (Earth Lusca) has ported its SprySOCKS backdoor to Windows and bolted on a kernel driver, RawWNPF, that hides processes, files, connections and registry keys, and turns any open TCP port into a hidden door and erases itself from every tool you’d use to find it.
- APT
Bottom line. Treat a SprySOCKS WIN_DRV infection as a stealthy, kernel-level espionage foothold that will not show up in netstat or Task Manager. Do not rely on on-host tools for triage, pivot to EDR/kernel telemetry and memory forensics, distrust the leaked PastDSE code-signing certificate, and hunt the persistence artifacts (IFEO on vds.exe, the ApphostRagistreationVerifier task, the VSPMsg print processor, and .dat payloads in %SystemRoot%\Fonts).
Background
SprySOCKS began life as a Linux-only backdoor that Trend Micro tied to Earth Lusca in 2023; its code derives from the open-source Trochilus RAT and shares traits with RedLeaves. In June 2026, ESET disclosed two previously undocumented Windows variants of SprySOCKS v1.8, internally labelled WIN_DRV and WIN_PLUS, used by FishMonger (aka Earth Lusca, TAG-22, Aquatic Panda, Red Dev 10), a China-aligned group under the Winnti umbrella believed to be operated by the contractor I-SOON.
ESET assessed the attribution with high confidence based on code overlap, operational characteristics and infrastructure. Samples surfaced on VirusTotal, but telemetry shows real-world activity in 2023-2024 primarily against government organizations in Honduras, Taiwan, Thailand and Pakistan. Both variants ship a hardcoded C&C config, speak TCP, UDP and WebSocket, and expose 30+ commands for reconnaissance, process and service control, file operations and remote execution. Optional surveillance modules log keystrokes, clipboard contents and active window titles.
What we observed
Two variants share a backdoor but differ sharply in stealth. Across ESET’s analysis the standout behaviours were:
- WIN_DRV chains legitimate, signed software into a kernel compromise. A batch script stages components into %SystemRoot%\Fonts and creates a SYSTEM scheduled task (ApphostRagistreationVerifier) that DLL-side-loads the malicious tpsvcloc.dll via a renamed, signed Microsoft binary; persistence is reinforced by registering that binary as an Image File Execution Options debugger for vds.exe.
- The loader decrypts its payload container (128-bit AES-ECB, hardcoded key uXQLESMXGaRMs6BL), injects the backdoor shellcode into svchost.exe via process doppelganging using a token stolen from spoolsv.exe, then drops DriverLoader to C:\Windows\System32\drivers\fsdiskbit.sys and loads it via a throwaway service key (msidiskserver) and NtLoadDriver, deleting the key and file afterwards to cover tracks.
- fsdiskbit.sys (DriverLoader) is signed with a LEAKED certificate taken from the GitHub PastDSE project, allowing it to satisfy Driver Signature Enforcement on outdated or misconfigured systems. Its only job is to manually memory-map a second driver, RawWNPF, so the rootkit never touches disk as a loaded image.
- RawWNPF (device \Device\RawWNPF) is the rootkit. Via custom IOCTLs (0x222000 initialize, 0x220350/0x220354/0x220358 hidden-process list, 0x220200 hide/divert a TCP port, 0x222008 self-delete) it hooks NtQuerySystemInformation to hide processes (InfinityHookPro-style), hooks nsiproxy.sys IOCTL 0x12001B to hide connections from netstat, and registers minifilter callbacks to protect its files in %SystemRoot%\Fonts and hide registry keys.
- The driver builds a passive backdoor. Using Windows Filtering Platform filters it inspects IPv4 traffic and diverts TCP received on ANY open port to the backdoor’s hidden local port, but only when specially crafted magic data is present, so operators reach the implant without a C&C address in the binary or an exposed listening port. C2 magic values are 0xACACBCBC (TCP), 0xACACBFBC (UDP) and 0x1BDCCBAA (WebSocket).
- WIN_PLUS drops the kernel driver but keeps the stealth loading: it persists as a malicious print processor (VSPMsg.dll registered under Print Processors\VSPMsg, executed by spoolsv.exe), stores encrypted payloads in spooler directories, and injects into svchost.exe via process doppelganging. Its single hardcoded C&C is
207.148.78[.]36(443/TCP, 53/UDP, 80/WebSocket) on Vultr. ESET also noted limited, unconfirmed evidence of a possible UEFI bootkit component (CVE-2023-24932).
SprySOCKS WIN_DRV attack chain
The driver loads in memory only and deletes its on-disk artifacts, hunt from kernel telemetry, not netstat.
Attribution
ESET attributes both Windows variants to FishMonger / Earth Lusca (China-aligned, Winnti umbrella, reportedly operated by contractor I-SOON) with high confidence, citing code similarity to the Linux SprySOCKS, shared HP-Socket networking and Trochilus lineage, reused AES keys and magic values across components, and infrastructure in the 207.148.64.0/20 Vultr range previously used by the group. We relay that assessment; targeting of government bodies in Honduras, Taiwan, Thailand and Pakistan is consistent with state-aligned espionage.
Confidence: 85%.
A leaked certificate gets the driver into the kernel; from there the rootkit turns any open TCP port into a hidden door and erases itself from every tool you’d use to find it.
Tactics, techniques & procedures (MITRE ATT&CK)
Techniques below are drawn directly from the analysed samples/reporting – no technique is asserted without evidence:
| Tactic | Technique | ID | Evidence |
|---|---|---|---|
| Initial Access | Exploit Public-Facing Application | T1190 | FishMonger gains entry via N-day flaws in internet-facing servers; ESET urges patching public-facing apps to cut the entry vector. |
| Defense Evasion | DLL Side-Loading | T1574.002 | Renamed signed ApphostRagistreationVerifier.exe side-loads malicious tpsvcloc.dll via tpsvc.dll (MFC satellite DLL). |
| Persistence | Scheduled Task | T1053.005 | Task ‘ApphostRagistreationVerifier’ runs the side-loading EXE as SYSTEM at every start. |
| Persistence | IFEO Injection | T1546.012 | Registers the loader EXE as a debugger for vds.exe under Image File Execution Options. |
| Persistence | Print Processors | T1547.012 | WIN_PLUS installs VSPMsg.dll as a print processor executed by spoolsv.exe. |
| Defense Evasion | Process Doppelganging | T1055.013 | Backdoor shellcode injected into svchost.exe using a token from spoolsv.exe; temp file prefixed TH. |
| Defense Evasion | Code Signing (Subvert Trust Controls) | T1553.002 | fsdiskbit.sys signed with a leaked certificate from the GitHub PastDSE project to satisfy DSE. |
| Defense Evasion | Rootkit | T1014 | RawWNPF hooks NtQuerySystemInformation and nsiproxy.sys to hide processes, files, connections and registry keys. |
| Command and Control | Traffic Signaling: Socket Filters | T1205.002 | WFP filters divert TCP on any open port to the hidden backdoor port when magic value 0xACACBCBC is present. |
| Collection | Input Capture: Keylogging | T1056.001 | Optional module logs keystrokes, clipboard contents and active window titles to encrypted files. |
MITRE ATT&CK techniques by tactic
Indicators of compromise
Defenders can block or hunt the following:
| Indicator | Type | Note |
|---|---|---|
207[.]148[.]78[[.]]36 | ipv4 | Hardcoded C&C (WIN_PLUS) – 443/TCP, 53/UDP, 80/WebSocket; Vultr, range 207.148.64.0/20 |
fsdiskbit[.]sys | sha256 | DriverLoader dropped to C:\Windows\System32\drivers\; signed with leaked PastDSE certificate |
| \Device\RawWNPF | url | Rootkit driver device object; configured via IOCTLs 0x2202xx / 0x2200xx / 0x22200x |
tpsvcloc[.]dll | sha256 | SprySOCKS loader delivered via DLL side-loading (with legitimate tpsvc.dll) |
VSPMsg[.]dll | sha256 | WIN_PLUS first-stage loader; malicious print processor in spool\prtprocs\x64 |
| msidiskserver | url | Throwaway service registry key used with NtLoadDriver to load fsdiskbit.sys, then deleted |
| uXQLESMXGaRMs6BL | url | Hardcoded 128-bit AES-ECB key reused across loader, DriverLoader and containers |
| 0xACACBCBC / 0xACACBFBC / 0x1BDCCBAA | url | C&C magic values for TCP / UDP / WebSocket channels (network hunt signatures) |
| E7484C24B88A1A2407A8F09D734F9A993670285B | sha256 | SHA-1 of klelam00007.zip – VirusTotal archive containing the WIN_DRV variant and components |
Detection
Copy-ready hunting query:
index=windows (EventCode=7045 OR EventCode=13 OR EventCode=11)
| eval obj=lower(coalesce(ServiceFileName, ImagePath, TargetObject, TargetFilename))
| search (obj="*\\drivers\\fsdiskbit.sys*" OR obj="*msidiskserver*" OR obj="*\\fonts\\*.dat" OR obj="*\\image file execution options\\vds.exe*" OR obj="*\\print processors\\vspmsg*" OR obj="*\\prtprocs\\x64\\vspmsg.dll*" OR obj="*tpsvcloc.dll*")
| stats count min(_time) as first_seen values(obj) as artifact by host, EventCode, userRecommendations
- Patch internet-facing applications aggressively – FishMonger favours N-day exploitation of public servers (Fortinet, GitLab, Exchange, Telerik, Zimbra) for initial access.
- Enforce Driver Signature Enforcement with HVCI/Memory Integrity and keep Microsoft’s vulnerable/revoked-driver and certificate blocklists current; explicitly distrust the leaked PastDSE code-signing certificate and alert on NtLoadDriver / new kernel-service registry keys.
- Because the rootkit hides processes and connections from on-host tools, triage from EDR/kernel telemetry and memory forensics – hunt for NtQuerySystemInformation and nsiproxy.sys hooks (InfinityHook-style) and memory-mapped, non-file-backed drivers.
- Hunt the persistence artifacts: IFEO debugger values (especially on vds.exe), the ApphostRagistreationVerifier scheduled task, print-processor registrations (VSPMsg), and executables or .dat payloads staged in %SystemRoot%\Fonts and the print spooler directories.
- Block and monitor C&C
207.148.78[.]36and the wider Vultr 207.148.64.0/20 range, and watch for the passive-backdoor pattern – TCP payloads carrying magic 0xACACBCBC (and UDP/WebSocket equivalents) diverted across arbitrary open ports. - On confirmed detection: isolate the host, capture a memory image before reboot (the driver lives in memory), forensically review kernel persistence, rebuild from known-good media, and rotate credentials exposed to the SYSTEM-level implant.
