# FishMonger's arsenal upgraded: SprySOCKS for Windows

DevFeed: [FishMonger's arsenal upgraded: SprySOCKS for Windows](<https://devfeed.tech/articles/fishmonger-s-arsenal-upgraded-sprysocks-for-windows-8368.md>)

Original publisher: [Read original article](<https://www.welivesecurity.com/en/eset-research/fishmongers-arsenal-upgraded-sprysocks-windows/>)

Author: ESET Research

Published: 2026-06-16T08:54:04Z

Content type: article

Language: en

Sources: [WeLiveSecurity](<https://devfeed.tech/sources/welivesecurity.md>)

Topics: [backdoor](<https://devfeed.tech/topics/backdoor.md>), [Processes](<https://devfeed.tech/topics/processes.md>), [telemetry](<https://devfeed.tech/topics/telemetry.md>)

Tags: [analysis](<https://devfeed.tech/tags/analysis.md>), [apt](<https://devfeed.tech/tags/apt.md>), [backdoor](<https://devfeed.tech/tags/backdoor.md>), [china](<https://devfeed.tech/tags/china.md>), [communication](<https://devfeed.tech/tags/communication.md>), [drivers](<https://devfeed.tech/tags/drivers.md>), [eset-research](<https://devfeed.tech/tags/eset-research.md>), [government](<https://devfeed.tech/tags/government.md>), [kernel](<https://devfeed.tech/tags/kernel.md>), [linux](<https://devfeed.tech/tags/linux.md>), [malware](<https://devfeed.tech/tags/malware.md>), [process](<https://devfeed.tech/tags/process.md>), [processes](<https://devfeed.tech/tags/processes.md>), [telemetry](<https://devfeed.tech/tags/telemetry.md>), [virustotal](<https://devfeed.tech/tags/virustotal.md>), [windows](<https://devfeed.tech/tags/windows.md>)

## AI overview

ESET reports two previously undocumented Windows variants of the SprySOCKS backdoor attributed to FishMonger. The variants use TCP, UDP, and WebSocket communications; WIN_DRV uses a kernel driver to conceal artifacts and redirect specially crafted TCP traffic.

## Source excerpt

ESET researchers have discovered SprySOCKS for Windows, FishMonger's backdoor weaponizing a kernel driver for advanced stealthiness