{"id":274189,"date":"2026-06-16T05:00:00","date_gmt":"2026-06-16T09:00:00","guid":{"rendered":"https:\/\/news-you-need.com\/index.php\/2026\/06\/16\/windows-version-of-sprysocks-linux-malware-used-to-attack-govt-orgs\/"},"modified":"2026-06-16T05:25:22","modified_gmt":"2026-06-16T09:25:22","slug":"windows-version-of-sprysocks-linux-malware-used-to-attack-govt-orgs","status":"publish","type":"post","link":"https:\/\/news-you-need.com\/index.php\/2026\/06\/16\/windows-version-of-sprysocks-linux-malware-used-to-attack-govt-orgs\/","title":{"rendered":"Windows version of SprySOCKS Linux malware used to attack govt orgs"},"content":{"rendered":"

Windows version of SprySOCKS Linux malware used to attack govt orgs<\/a><\/p>\n

https:\/\/www.bleepingcomputer.com\/news\/security\/windows-version-of-sprysocks-linux-malware-used-to-attack-govt-orgs\/<\/a><\/p>\n

Publish Date: 2026-06-16 05:00:00<\/a><\/p>\n

Source Domain: www.bleepingcomputer.com<\/a><\/p>\n

\n

Windows variants for the SprySOCKS Linux malware have been used in attacks targeting government organizations in at least four countries.<\/p>\n

SprySOCKS has been\u00a0linked to the Chinese threat group \u2018Earth Lusca,\u2019 which deployed it in attacks against government entities focused on foreign affairs, technology, and telecommunications.<\/p>\n

Now, ESET researchers discovered Windows variants of the same malware family that were used between 2023 and 2024 in attacks\u00a0on\u00a0government organizations in Taiwan, Thailand, Pakistan, and Honduras.<\/p>\n

\"image\"<\/p>\n

ESET attributes\u00a0the activity with high confidence to the Earth Lusca threat actor, which they track as \u2018FishMonger\u2019 (also \u2018Aquatic Panda,\u2019 \u2018Red Dev 10,\u2019 and TAG-22).<\/p>\n

Unlike the previously documented Linux version, the Windows\u00a0variant adds kernel-level stealth capabilities\u00a0allowing operators to hide malware artifacts and communicate with the backdoor through traffic redirected from arbitrary TCP ports<\/p>\n

The two variants are WIN_DRV, which features kernel drivers for rootkit-like capabilities, and WIN_PLUS,\u00a0a more barebones backdoor.<\/p>\n

Both variants offer the following capabilities:<\/p>\n