China-Linked SprySOCKS Backdoor Expands to Windows: A Deep Dive into the Evolving Threat Landscape
The cybersecurity world is abuzz with the news that a backdoor once believed to be exclusive to Linux systems has now been spotted on Windows. This development not only highlights the evolving nature of cyber threats but also underscores the importance of staying vigilant against sophisticated, multi-platform attacks. In this article, I'll delve into the details of this discovery, explore its implications, and offer some insights into what it might mean for organizations and individuals alike.
The SprySOCKS Backdoor: A Brief History
SprySOCKS is a backdoor that has been making waves in the cybersecurity community since its initial discovery in September 2023. Initially identified as a Linux-only threat, it was attributed to a China-nexus state-sponsored actor known as Earth Lusca, also tracked under various monikers like Aquatic Panda, Bronze University, Charcoal Typhoon, and RedHotel. The actor is believed to have been active since at least 2021, operating through a Chinese contractor named i-Soon.
What makes SprySOCKS particularly intriguing is its connection to the Winnti umbrella, a broader cyber espionage group. In March 2025, ESET linked SprySOCKS to a global campaign dubbed Operation FishMedley, which targeted organizations in Taiwan, Hungary, Turkey, Thailand, France, and the U.S. between January and October 2022. This campaign underscores the group's ability to adapt and expand its reach across different platforms and regions.
The Windows Expansion: WINDRV and WINPLUS
The recent discovery of Windows variants of SprySOCKS, internally marked as WINDRV and WINPLUS, marks a significant expansion of the threat's capabilities. Both variants retain the core architecture of their Linux counterparts, including the C&C protocol, encryption used, and overall command handling logic. However, they introduce several enhancements to improve stealthiness and functionality on the Windows platform.
WIN_DRV: Kernel Driver-Based Stealth
WIN_DRV, the kernel driver-based variant, utilizes a driver referred to as RawWNPF for advanced stealth. This driver is loaded using another encrypted kernel driver named DriverLoader, making it difficult for security tools to detect. The attack chain involves an initial access pathway that drops a batch script, which then creates and executes a scheduled task to trigger a DLL side-loading chain. This chain ultimately drops the SprySOCKS backdoor and the driver components.
One of the most intriguing aspects of WIN_DRV is its ability to divert TCP traffic, allowing operators to send commands to the backdoor through a random TCP port on the victim's device without exposing the backdoor's actual listening port in network traffic. This feature highlights the group's sophistication and adaptability in evading detection.
WIN_PLUS: Leveraging the Print Spooler Service
WIN_PLUS, on the other hand, adopts a different approach. It leverages the Windows Print Spooler service (spoolsv.exe) as a starting point to execute a first-stage loader. This loader injects and runs a SprySOCKS loader into a newly created svchost.exe process, launching the backdoor. This method showcases the group's ability to exploit existing services and processes to maintain persistence and evade detection.
Both WINDRV and WINPLUS variants support three channels for C2 communications over TCP, UDP, and WebSocket, enabling operators to run various commands on the compromised host. These commands include collecting system information, launching an interactive console, enumerating processes, getting C2 communication details, listing all services, initializing a SOCKS proxy, uploading/downloading files, and running existing files.
Implications and Insights
The discovery of Windows variants of SprySOCKS has several implications for organizations and individuals. Firstly, it underscores the importance of maintaining a comprehensive security posture that addresses vulnerabilities across multiple platforms. This includes keeping software up-to-date, implementing robust access controls, and monitoring network traffic for suspicious activity.
Secondly, the expansion of SprySOCKS to Windows highlights the need for continuous monitoring and threat hunting. Security teams should be on the lookout for unusual network traffic, process activity, and file system changes that could indicate the presence of the backdoor. Additionally, organizations should consider implementing endpoint detection and response (EDR) solutions to detect and respond to threats in real-time.
Lastly, the discovery of SprySOCKS on Windows serves as a reminder of the importance of supply chain security. Organizations should carefully vet their suppliers and partners to ensure that they are not introducing vulnerabilities or backdoors into their systems. This includes conducting regular security assessments and audits of third-party software and services.
Conclusion: A Call to Action
The discovery of Windows variants of SprySOCKS is a stark reminder of the evolving threat landscape and the need for organizations and individuals to stay vigilant. As cyber threats continue to evolve and adapt, it is crucial to adopt a comprehensive and layered security approach that addresses vulnerabilities across multiple platforms. By staying informed, implementing best practices, and investing in robust security solutions, we can mitigate the risk of falling victim to sophisticated, multi-platform attacks.
Personally, I think that this discovery highlights the importance of continuous monitoring and threat hunting. Security teams should be proactive in identifying and responding to threats, rather than relying on reactive measures. Additionally, I believe that organizations should consider investing in EDR solutions to detect and respond to threats in real-time. From my perspective, the SprySOCKS backdoor serves as a wake-up call for the cybersecurity community to stay ahead of the curve and protect against emerging threats.
