The New Oil#Windows version of #SprySOCKS #Linux #malware used to attack govt orgs
securityaffairs#China-Linked #FishMonger Ports #SprySOCKS to #Windows With Kernel-Level Stealth and UEFI Bootkit Hints
https://securityaffairs.com/193728/apt/china-linked-fishmonger-ports-sprysocks-to-windows-with-kernel-level-stealth-and-uefi-bootkit-hints.html
#securityaffairs #hacking #malware
https://securityaffairs.com/193728/apt/china-linked-fishmonger-ports-sprysocks-to-windows-with-kernel-level-stealth-and-uefi-bootkit-hints.html
#securityaffairs #hacking #malware
RedPacket SecuritySprySOCKS backdoor expands from Linux to Windows with kernel-level stealth - https://www.redpacketsecurity.com/sprysocks-backdoor-expands-from-linux-to-windows/
CyberNetsecIO📰 China-Linked SprySOCKS Backdoor Adds Windows Variants with Kernel-Level Stealth
🇨🇳 China-linked 'FishMonger' group upgrades SprySOCKS backdoor for Windows. New variant uses a kernel driver for advanced stealth, hiding files, processes, and network activity. 🕵️♂️ #SprySOCKS #FishMonger #Winnti #CyberEspionage #Malware
🌐 cyber[.]netsecops[.]io
Analyst207China-Linked Backdoor Expands to Windows with Kernel Stealth
A China-linked espionage group has unleashed a stealthy backdoor that infiltrates Windows systems, targeting government bodies in Honduras, Taiwan, Thailand, and Pakistan. The malware, known as SprySOCKS, boasts advanced espionage features and kernel-level stealth, making it a formidable threat.
#ChinalinkedBackdoor #Sprysocks #Fishmonger #KernelStealth #WindowsMalware
ESET Research#ESETresearch discovered two as-yet undocumented Windows variants of #SprySOCKS, a previously Linux-only backdoor reportedly used by #FishMonger. We attribute the new Windows variants to #FishMonger with high confidence. https://www.welivesecurity.com/en/eset-research/fishmongers-arsenal-upgraded-sprysocks-windows/
Both newly discovered Windows variants, named WIN_PLUS and WIN_DRV by their authors, support communication over TCP, UDP, and WebSocket protocols, while WIN_DRV weaponizes a kernel driver for enhanced stealth.
The WIN_DRV variant creates a stealthy passive TCP backdoor and uses a kernel driver to redirect traffic to the backdoor’s hidden TCP port whenever specially crafted data is detected inside a received TCP packet.
IoCs available in our GitHub repo: https://github.com/eset/malware-ioc/tree/master/sprysocks
Read the full analysis on WeLiveSecurity: https://www.welivesecurity.com/en/eset-research/fishmongers-arsenal-upgraded-sprysocks-windows/
Both newly discovered Windows variants, named WIN_PLUS and WIN_DRV by their authors, support communication over TCP, UDP, and WebSocket protocols, while WIN_DRV weaponizes a kernel driver for enhanced stealth.
The WIN_DRV variant creates a stealthy passive TCP backdoor and uses a kernel driver to redirect traffic to the backdoor’s hidden TCP port whenever specially crafted data is detected inside a received TCP packet.
IoCs available in our GitHub repo: https://github.com/eset/malware-ioc/tree/master/sprysocks
Read the full analysis on WeLiveSecurity: https://www.welivesecurity.com/en/eset-research/fishmongers-arsenal-upgraded-sprysocks-windows/
Earth Lusca Expands Arsenal with Windows SprySOCKS Malware
Chinese threat actor Earth Lusca has upgraded its malware arsenal with Windows SprySOCKS, a sneaky tool that lets hackers secretly send commands to compromised devices, allowing them to fly under the radar. This latest move has been linked to a string of high-profile attacks on government organizations worldwide.
#EarthLusca #WindowsSprysocksMalware #Sprysocks #China #Government
bojkotiMalbonaLinux backdoor is a Windows malware knockoff: https://arstechnica.com/security/2023/09/never-before-seen-linux-backdoor-is-a-windows-malware-knockoff/
Benjamin Carr, Ph.D. 👨🏻💻🧬#Chinese hackers have unleashed a never-before-seen #Linux #backdoor
#SprySOCKS borrows from open source Windows #malware and adds new tricks. https://arstechnica.com/security/2023/09/never-before-seen-linux-backdoor-is-a-windows-malware-knockoff/
#SprySOCKS borrows from open source Windows #malware and adds new tricks. https://arstechnica.com/security/2023/09/never-before-seen-linux-backdoor-is-a-windows-malware-knockoff/
CurnyThe China-linked #threat actor known as Earth Lusca has been observed targeting #government entities using a never-before-seen #Linux #backdoor called #SprySOCKS.
https://thehackernews.com/2023/09/earth-luscas-new-sprysocks-linux.html
