SprySOCKS Windows malware is one of the most significant APT threats to emerge in 2026 — a fully ported backdoor that now runs natively on Windows, armed with kernel-level stealth, 30+ commands, and a proxy mechanism built for silent lateral movement. Originally a Linux-only tool attributed to the China-aligned FishMonger group, this Windows backdoor signals a dangerous escalation in state-linked cyber espionage. If your organisation runs Windows — and the vast majority do — this threat demands your immediate attention.
What Is SprySOCKS and Who Is Behind It?
SprySOCKS is a sophisticated backdoor malware first documented on Linux systems and attributed to FishMonger, a China-nexus advanced persistent threat (APT) group also tracked in connection with broader Earth Lusca activity. Researchers at ESET discovered two previously undocumented Windows backdoor variants of SprySOCKS, revealing that FishMonger has invested heavily in porting and enhancing the tool specifically for Windows environments.
The group primarily targets government entities — ESET telemetry confirmed victims across at least four countries in Asia and Latin America. FishMonger is not a financially motivated criminal gang; this is state-level espionage, focused on long-term access, intelligence gathering, and covert exfiltration.
How the SprySOCKS Proxy Backdoor Actually Works
The SprySOCKS proxy architecture is designed for persistence and evasion above all else. Once deployed, it operates across multiple communication channels — TCP, UDP, and WebSocket — giving operators maximum flexibility to maintain C2 (command-and-control) connectivity even in restricted network environments.
The Two Windows Variants
ESET identified two distinct variants in its research:
-
WIN_DRV — This variant deploys two kernel-mode drivers, RawWNPF and DriverLoader, which work in tandem to hide processes, files, registry keys, and active network connections from the operating system. This is rootkit-level concealment, making conventional endpoint scanners essentially blind to its presence.
-
A second, lighter variant — This version abuses the Windows Print Spooler service as a persistence mechanism, embedding itself into a legitimate system process to survive reboots and avoid obvious artefacts on disk.
The 30+ Command Capability Set
Both variants expose an operator command set of more than 30 individual instructions. These include file system operations, process management, credential harvesting, SOCKS5 proxy tunnelling (the feature that gives SprySOCKS its name), and full remote shell access. The breadth of this APT malware threat command set means an operator can essentially perform any post-exploitation action without deploying secondary tools — reducing the overall footprint of the attack.
Kernel-Level Stealth: Why This APT Malware Threat Is Hard to Catch
Traditional antivirus engines and endpoint detection tools operate at user-mode level — above the kernel. The WIN_DRV variant of this Windows backdoor instals its malicious drivers at kernel level, which means it can actively intercept and manipulate the very system calls that security tools rely on to detect threats. In practical terms, the malware can make itself invisible to process explorers, network monitors, file-system auditing tools, and many endpoint detection and response (EDR) platforms.
There are also hints of UEFI bootkit capability in artefacts ESET recovered — suggesting FishMonger may be developing persistence that survives even a full OS reinstall. While this capability has not yet been confirmed in the wild, the trajectory is deeply concerning for defenders.
SprySOCKS Proxy: Lateral Movement and Data Exfiltration Explained
The SOCKS5 proxy component at the heart of this SprySOCKS Windows malware is what makes it particularly dangerous for enterprise networks. Once a single endpoint is compromised, the backdoor transforms that machine into a relay point. Attackers can route traffic through the infected host to reach otherwise inaccessible internal network segments — pivoting from a perimeter machine into core infrastructure without ever directly touching those systems from the internet.
This SprySOCKS proxy tunnelling behaviour mirrors the technique seen in tools like Cobalt Strike’s SOCKS proxy feature, but with the added advantage of kernel-level concealment. Network defenders monitoring for anomalous outbound connections may see only legitimate-looking traffic to approved domains — the real C2 channel is hidden beneath.
Data exfiltration follows the same principle: files, credentials, and configuration data are staged on the compromised host, then trickled out through the encrypted proxy channel at intervals chosen to avoid triggering volume-based detection rules.
Detection Methods: How to Identify This Windows Backdoor
Detecting a kernel-level Windows backdoor like SprySOCKS requires a layered approach. No single tool will catch it reliably. ESET’s published research provides indicators of compromise (IoCs) including specific driver hashes, registry key patterns, and C2 infrastructure signatures — these should be loaded into your SIEM and threat intelligence platform immediately.
Recommended Detection Strategies
-
Kernel driver auditing — Monitor for the loading of unsigned or newly-signed kernel drivers, especially those not belonging to your known hardware inventory. Windows Event ID 7045 logs new service installations, including driver loads.
-
Print Spooler anomalies — The second SprySOCKS variant abuses Print Spooler. Audit spoolsv.exe child processes and flag any unexpected DLL injections or network connections originating from the spooler.
-
SOCKS5 traffic patterns — Inspect outbound connections for SOCKS5 tunnelling signatures, unusual WebSocket sessions to non-standard ports, and long-lived TCP connections to external IPs that do not match expected business traffic.
-
EDR with kernel visibility — Only EDR solutions with their own kernel-mode components can reliably see what a kernel-level rootkit is hiding. Evaluate whether your current endpoint security operates below the rootkit’s level.
-
Threat intelligence feeds — Subscribe to feeds that include FishMonger and Earth Lusca IoCs. ESET’s WeLiveSecurity research blog published the full technical breakdown including YARA rules and network signatures you can deploy directly.
Defence Strategies Against the APT Malware Threat
Defending against a threat actor of FishMonger’s sophistication is not simply a matter of patching known CVEs. The group deploys custom tools precisely to avoid signature-based detection. Your defence posture needs to be architectural, not just tool-based.
Harden Your Windows Environment
-
Enable Windows Defender Credential Guard — Prevents credential harvesting from LSASS, cutting off a key post-exploitation step. Available on Windows 11 Pro and Enterprise editions.
-
Enable Driver Signature Enforcement — Ensures only Microsoft-signed drivers can load at kernel level. Disable test-signing mode on all production systems and enforce Secure Boot.
-
Disable Print Spooler on non-printing hosts — If a server or workstation does not need print functionality, disable and stop the spooler service entirely. This removes one of SprySOCKS’s two persistence mechanisms by default.
-
Apply the Principle of Least Privilege — Kernel driver installation requires SYSTEM-level privilege. Ensuring users and service accounts operate with minimal rights reduces the blast radius of an initial compromise.
-
Network segmentation — Contain lateral movement by enforcing strict east-west traffic controls. Zero-trust network architecture prevents a compromised endpoint from freely reaching internal segments even with a working SOCKS5 proxy.
Keep Windows Fully Updated
A genuinely current and licensed Windows installation is the baseline for all of these defences. Microsoft continuously patches kernel-level vulnerabilities and tightens driver signing enforcement with each update cycle. Running an unpatched or unlicensed Windows build dramatically widens the attack surface that a group like FishMonger is actively hunting for. Keeping a legitimate, fully activated Windows licence ensures you receive every security patch the moment Microsoft releases it — you can explore genuine Windows 11 licence keys at Top Key Shop to ensure your devices are covered. For users still on an older build, a trusted antivirus solution from the Top Key Shop security range adds a critical additional layer of endpoint protection.
SprySOCKS in Context: The Bigger APT Picture
SprySOCKS does not exist in isolation. FishMonger has previously deployed a range of tools including ShadowPad, Cobalt Strike beacons, and various custom loaders. The porting of SprySOCKS to Windows is consistent with a pattern seen across multiple China-aligned APT groups: develop a stable Linux tool, then invest in a Windows port that exploits the platform’s wider enterprise install base.
The choice of government targets in Asia and Latin America also reflects deliberate geopolitical targeting — this is intelligence collection, not opportunistic ransomware. Organisations that support or interact with those governments, including NGOs, contractors, and academic institutions, should treat themselves as potential secondary targets.
For a broader perspective on how similarly structured malware campaigns are constructed, it is worth reviewing our recent analysis of the Gentlemen ransomware Go encryptor, which shares several lateral movement techniques with the SprySOCKS toolkit.
FAQ: SprySOCKS Windows Malware
What is SprySOCKS malware?
SprySOCKS is an advanced backdoor malware attributed to FishMonger, a China-aligned APT group. Originally built for Linux, it has now been ported to Windows in two distinct variants. It provides operators with more than 30 remote commands, a SOCKS5 proxy for lateral movement, and — in its most advanced form — kernel-level rootkit capabilities that hide its presence from conventional security tools.
Who does SprySOCKS target?
ESET research confirmed that FishMonger has used SprySOCKS Windows variants to target government organisations across at least four countries in Asia and Latin America. However, any organisation connected to those government entities — suppliers, contractors, research institutions — should consider itself a potential target through supply-chain or watering-hole attacks.
How does the SprySOCKS proxy work?
The SOCKS5 proxy component allows attackers to tunnel network traffic through a compromised Windows machine, reaching internal network segments that would otherwise be inaccessible from the internet. Communication travels over TCP, UDP, or WebSocket connections, and the kernel-driver variant actively hides these connections from the operating system’s own monitoring interfaces.
Can standard antivirus detect SprySOCKS?
The kernel-driver variant of SprySOCKS is specifically designed to evade user-mode security tools, including many standard antivirus engines. Detection requires EDR solutions with kernel-level visibility, YARA rules derived from ESET’s published IoCs, and network-based anomaly detection. ESET’s own security products include updated signatures following the research publication.
What is the fastest way to reduce exposure to this threat?
Immediately disable Print Spooler on non-printing hosts, enforce Driver Signature Enforcement and Secure Boot on all Windows machines, apply all pending Windows security updates, and load ESET’s published indicators of compromise into your SIEM. Network segmentation should be reviewed to limit how far any compromised host can reach into internal infrastructure.
