SprySOCKS Windows Backdoor Uses Kernel Driver to Hide Processes, Files, and Network Traffic

**Executive summary:** ESET researchers identified two Windows ports of the Linux SprySOCKS backdoor (WIN_DRV and WIN_PLUS) attributed to the FishMonger APT; WIN_DRV includes a signed DriverLoader and a RawWNPF kernel-mode rootkit that hides processes, files, registry keys and network ports and can redirect TCP flows to a hidden listener, while WIN_PLUS uses a print-processor-style loader and svchost injection for persistence; telemetry links activity in 2023–2024 targeting government entities in Honduras, Taiwan, Thailand, and Pakistan, and the report provides C2 details, hardcoded crypto keys, over 30 backdoor commands, and a set of IOCs for hunting and response.