SprySOCKS Crosses Over: Windows Variants Surface With Driver-Level Hiding

SprySOCKS is no longer Linux-only.

Researchers have identified two previously undocumented Windows variants of the backdoor, a tool tied to China-aligned intrusion activity and first publicly documented in 2023 as a Linux implant derived from the open-source Trochilus RAT. The new samples are internally tagged WIN_DRV and WIN_PLUS, and both ship with hard-coded command-and-control configurations.

That detail matters. Hard-coded C2 means no dead-drop resolver, no DGA, no fallback channel pulled from a benign-looking webpage. Operators are confident the infrastructure will stay up — or confident enough to burn samples when it doesn't.

The variants support TCP and UDP for C2 communication. WIN_DRV, as the name suggests, leans on a driver component for stealth, pushing portions of the implant's behavior into kernel space where standard EDR telemetry thins out. WIN_PLUS appears to be the user-mode counterpart.

Attribution, per the researchers behind the find, points to Earth Lusca, a Chinese-speaking cluster also tracked under overlapping names by other vendors. Earth Lusca has historically targeted government, telecom, and academic networks across Southeast Asia, the Balkans, and Latin America. The group's tooling has long blended commodity malware with custom implants, and SprySOCKS itself was assembled from leaked source code rather than written from scratch.

The move to Windows expands the targeting surface considerably. Linux SprySOCKS was largely a server-side problem — internet-facing appliances, Linux web infrastructure, the usual suspects. WIN_DRV and WIN_PLUS bring the same operator playbook to endpoints, file servers, and the workstations of people who actually read email.

No CVE is involved here. SprySOCKS is post-exploitation tooling, not an initial-access exploit, which means delivery still depends on whatever vulnerability or phishing lure the operators choose on the day. Earth Lusca has previously chained known flaws in Fortinet, GoAnywhere, and Microsoft Exchange products to drop earlier-stage payloads.

The driver angle is worth watching. Windows kernel drivers require signing, and abuse of signed-but-vulnerable drivers — the BYOVD pattern — has become a reliable way for state-aligned crews to blind security tooling. Whether WIN_DRV uses a stolen cert, a Microsoft attestation-signed driver, or a BYOVD shim is the question defenders should be asking their threat-intel vendors right now.

For defenders:

• Hunt for unsigned or recently signed kernel drivers loading from non-standard paths. Microsoft's vulnerable driver blocklist should be enforced, not just enabled in audit mode.
• Egress filter outbound TCP and UDP from server segments. Hard-coded C2 is brittle by design; block the IPs and the implant goes deaf.
• Review any Linux-side SprySOCKS indicators from prior reporting against Windows endpoints. Operators recycle infrastructure.

No breach notifications have been filed in connection with the Windows variants yet. That will likely change.