FishMonger Expands SprySOCKS Malware to Windows, Targeting Government Entities

ESET researchers identified two Windows variants of the SprySOCKS backdoor (WIN_DRV and WIN_PLUS) attributed to the FishMonger APT; WIN_DRV employs kernel-level techniques to hide processes, files, and network connections, both variants support 30+ C2 commands, and limited evidence suggests some attacks may have used a UEFI bootkit exploiting CVE-2023-24932. Activity was observed against government organizations in Honduras, Taiwan, Thailand, and Pakistan between 2023–2024.