SprySOCKS Backdoor Expands From Linux to Windows

**ESET analysis found Windows variants of the SprySOCKS backdoor used by FishMonger (Earth Lusca/Aquatic Panda), including a kernel-mode rootkit (WIN_DRV) that hides files, processes, registry keys and network connections, plus a feature-rich backdoor (WIN_PLUS); active targeting of government organizations across Honduras, Taiwan, Thailand and Pakistan was observed, and persistence techniques include DLL side‑loading and potential UEFI bootkit implantation.**