FishMonger Expands SprySOCKS Malware to Windows with Kernel-Level Stealth

ESET researchers identified two Windows variants (WIN_DRV and WIN_PLUS) of the SprySOCKS backdoor used by the FishMonger APT, active in 2023–2024 and targeting government organizations in Honduras, Taiwan, Thailand, and Pakistan. WIN_DRV leverages kernel drivers to hide processes, network connections, and files, both variants implement 30+ C2 commands over TCP/UDP/WebSocket, and there are indications some intrusions involved a UEFI bootkit potentially exploiting CVE-2023-24932; organizations are advised to monitor for indicators and signs of compromise.