ESET researchers have identified two new Windows variants (WIN_DRV and WIN_PLUS) of the SprySOCKS backdoor, attributed to the Earth Lusca threat group, which expand its cross-platform capabilities. WIN_DRV uses kernel drivers for stealth and TCP traffic diversion, while WIN_PLUS exploits the Windows Print Spooler service; both variants support TCP, UDP, and WebSocket C2 communication and can execute over 30 system commands. The initial access vector is undetermined, though past exploits of Fortinet, GitLab, and Microsoft Exchange vulnerabilities have been noted, with targeting of government organizations in several countries.
Malware SprySOCKS backdoor expands to Windows with new variants June 16, 2026 Share By SC Staff Per The Hacker News, cybersecurity researchers at ESET have identified two new Windows variants of the SprySOCKS backdoor, previously believed to be exclusively for Linux systems. These new versions, internally designated WIN_DRV and WIN_PLUS, significantly expand the cross-platform capabilities of the threat actor. The Windows variants, WIN_DRV and WIN_PLUS, retain the core architecture of their Linux predecessor, including command-and-control (C2) protocols and encryption methods. They support communication over TCP, UDP, and WebSocket, and can execute over 30 commands for system information gathering, process management, and file operations. WIN_DRV utilizes kernel drivers for enhanced stealth, concealing network connections, processes, and registry keys. It also features TCP traffic diversion to mask its listening port. WIN_PLUS, conversely, exploits the Windows Print Spooler service to load the backdoor. These variants are attributed to the Earth Lusca threat group, also known as FishMonger, linked to state-sponsored cyber espionage activities. Evidence suggests these Windows versions may have been deployed between 2023 and 2024, targeting government organizations in Honduras, Taiwan, Thailand, and Pakistan. The initial access vector remains undetermined, though past exploits of vulnerabilities in Fortinet, GitLab, and Microsoft Exchange have been noted. Source: The Hacker News SC Staff Related Malware Malware distributed via Steam Workshop wallpapers SC Staff June 16, 2026 Kaspersky researchers have identified that malicious actors are exploiting the Steam Workshop platform, specifically through the Wallpaper Engine application, to distribute malware. Malware North Korean hackers use fake Microsoft alerts to deploy NarwhalRAT malware SC Staff June 16, 2026 The attackers send emails designed to raise alarm about potential account compromise and OTP abuse, tricking recipients into opening an attachment, according to the Genians Security Center. Malware New Argamal malware disguised as adult games targets users SC Staff June 15, 2026 The Argamal malware is distributed through adult game websites, file-sharing platforms, and torrent trackers. Get daily email updates SC Media's daily must-read of the most current and pressing daily news Business Email By clicking the Subscribe button below, you agree to SC Media Terms of Use and Privacy Policy . Subscribe Related Terms Adware You can skip this ad in 5 seconds