FishMonger’s arsenal upgraded: SprySOCKS for Windows

**ESET discovered two previously undocumented Windows variants of the SprySOCKS backdoor (WIN_DRV and WIN_PLUS) used by the FishMonger APT, describing loader chains, encrypted payloads, a kernel rootkit (RawWNPF) that hides files/processes/network connections and diverts TCP traffic, support for TCP/UDP/WebSocket C2 channels with >30 commands, observed victim telemetry across Honduras, Taiwan, Thailand and Pakistan, and provides IoCs and MITRE ATT&CK mappings.**