[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fq_IfMv-TdShxeoOFk2k_JMaG5GJXjAbnE4ELY4C03M4":3},{"article":4,"iocs":38,"watch_terms":39,"solutions":40,"lesson":118},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"c508ca11-31d3-4559-9476-e24e9325ac23","SprySOCKS Windows Variant Abuses Kernel Drivers to Evade Detection","sprysocks-windows-variant-abuses-kernel-drivers-to-evade-detection-7ed50a","FishMonger, a China-nexus threat group, has deployed an undocumented version of the Linux backdoor against government targets in Honduras, Taiwan, Thailand, and Pakistan.","A new variant of the SprySOCKS malware has been identified, specifically targeting Windows systems by abusing kernel drivers to bypass security measures and evade detection. This sophisticated technique allows the malware to operate with elevated privileges and remain hidden from standard security tools. The threat actor behind this campaign is believed to be FishMonger, a group with suspected ties to China, which has previously deployed a Linux version of the backdoor against government entities in multiple countries.","SprySOCKS malware variant uses kernel drivers to evade detection on Windows.","https:\u002F\u002Fwww.darkreading.com\u002Fthreat-intelligence\u002Fsprysocks-windows-variant-kernel-drivers","https:\u002F\u002Feu-images.contentstack.com\u002Fv3\u002Fassets\u002Fblt6d90778a997de1cd\u002Fbltfe5e902d31634190\u002F6a317c8da9a64d0008e8660f\u002Fbackdoor-BeeBright-Getty-823310866.jpg?width=720&quality=80&disable=upscale","2026-06-16T20:11:48+00:00","2026-06-16T20:00:23.053094+00:00",8,[17],{"name":18,"type":19},"FishMonger","threat_actor","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":20,"icon":22,"name":23,"slug":24},null,"Malware","malware",[26,31,33],{"category":27},{"id":28,"icon":22,"name":29,"slug":30},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":32},{"id":20,"icon":22,"name":23,"slug":24},{"category":34},{"id":35,"icon":22,"name":36,"slug":37},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[],{"controls":41,"vendors":117},[42,70,91],{"slug":43,"name":44,"problem":45,"products":46},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[47,55,63],{"vendor_slug":48,"vendor_name":49,"vendor_logo":50,"product_slug":51,"product_name":52,"url":53,"description":54},"wallix","WALLIX","\u002Fvendor-logos\u002Fwallix.png","wallix-pam","WALLIX PAM","https:\u002F\u002Fwww.wallix.com\u002Fproducts\u002Fprivileged-access-management-software\u002F","Privileged access management with session recording, for IT and OT environments.",{"vendor_slug":56,"vendor_name":57,"vendor_logo":58,"product_slug":59,"product_name":60,"url":61,"description":62},"delinea","Delinea","\u002Fvendor-logos\u002Fdelinea.png","secret-server","Delinea Secret Server","https:\u002F\u002Fdelinea.com\u002Fproducts\u002Fsecret-server","Vault for privileged credentials with discovery, rotation and session recording.",{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":43,"product_name":67,"url":68,"description":69},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","Privileged Access Management","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fprivileged-access-management","Gives elevated rights to specific applications only where needed, so users do not need local admin accounts.",{"slug":71,"name":72,"problem":73,"products":74},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[75,83],{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":87,"product_name":88,"url":89,"description":90},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"slug":92,"name":93,"problem":94,"products":95},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[96,104,109],{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":105,"product_name":106,"url":107,"description":108},"defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",[],{"slug":119,"title":120,"body":121,"framework_refs":122,"framework_notes":134},"sprysocks-malware-abuses-kernel-drivers-to-evade-windows-security-tools","SprySOCKS Malware Abuses Kernel Drivers to Evade Windows Security Tools","The SprySOCKS Windows variant, attributed to the Chinese-linked threat group FishMonger, exploits vulnerable or malicious kernel drivers to gain elevated privileges and evade detection — a technique known as Bring Your Own Vulnerable Driver (BYOVD). By operating at the kernel level, the malware can disable or bypass endpoint security tools that rely on standard OS interfaces. This matters because government and critical infrastructure targets may remain compromised for extended periods without awareness. The evolution from a Linux-only backdoor to a Windows variant signals an expanding attack surface and a maturing, resource-rich threat actor.",[123,124,125,126,127,128,129,130,131,132,133],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 10: Malware Defenses","CIS Control 13: Network Monitoring and Defense","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SP 800-53 CM-7: Least Functionality","NIST SP 800-53 AU-12: Audit Record Generation","NIST SP 800-53 AC-6: Least Privilege","MITRE ATT&CK T1068: Exploitation for Privilege Escalation","MITRE ATT&CK T1014: Rootkit","MITRE ATT&CK T1553.006: Subvert Trust Controls – Code Signing Policy Modification","NIST CSF DE.CM-4: Malicious Code Detection",{}]