SprySOCKS Crosses Over: Windows Variants Surface With Driver-Level Hiding

SprySOCKS is no longer Linux-only.

Key points

• ESET has identified two previously undocumented Windows variants of the SprySOCKS backdoor, internally tagged WIN_DRV and WIN_PLUS.
• Both variants ship with hard-coded command-and-control configurations and support TCP and UDP communication.
• WIN_DRV uses a driver component to push implant behavior into kernel space, where standard endpoint-detection telemetry thins out.
• Attribution points to Earth Lusca, a Chinese-speaking intrusion cluster with a history of targeting government and academic networks.
• No CVE is involved: SprySOCKS is post-exploitation tooling, meaning delivery still depends on a separate vulnerability or phishing lure.

What are WIN_DRV and WIN_PLUS?

ESET researchers flagged two previously undocumented Windows builds of SprySOCKS, a backdoor first publicly documented in 2023 as a Linux implant derived from leaked Trochilus RAT source code. WIN_DRV leans on a kernel driver for stealth, pushing behavior below the layer where most endpoint-detection tools collect telemetry. WIN_PLUS appears to be its user-mode counterpart. Both come with hard-coded C2, which means no domain-generation algorithm and no fallback channel pulled from a benign-looking page. Operators are either confident the infrastructure will hold, or willing to burn samples when it doesn't.

On 8 June 2026 we reported a similar cross-platform pivot, when VerdantBamboo ported its BRICKSTORM implant to BSD to reach boxes most EDR vendors had overlooked. The pattern is consistent: China-nexus crews are treating platform boundaries as a product roadmap, not a limit.

Should you worry about the driver component?

Yes, if you run Windows endpoints without enforced driver controls. Windows kernel drivers require a valid signature, and abuse of signed-but-vulnerable drivers, a technique known as BYOVD (bring your own vulnerable driver), has become a reliable method for state-linked crews to blind security tooling. Whether WIN_DRV relies on a stolen certificate, a Microsoft attestation-signed driver, or a BYOVD shim is the question defenders should be pressing their threat-intelligence vendors on. The answer changes the detection approach considerably.

Who is Earth Lusca?

Attribution points to Earth Lusca, a Chinese-speaking cluster tracked under overlapping names by multiple vendors. The group has targeted government and academic networks across Southeast Asia, the Balkans, and Latin America. Its tooling blends commodity malware with custom implants. Earth Lusca has previously chained known flaws in Fortinet and Microsoft Exchange products to drop earlier-stage payloads before deploying implants like SprySOCKS.

What does Windows targeting change?

Linux SprySOCKS was largely a server-side problem: internet-facing appliances and Linux web infrastructure. WIN_DRV and WIN_PLUS bring the same operator playbook to endpoints and the workstations of people who read email. That's a meaningful expansion of the targeting surface, and the hard-coded C2 suggests the operators ran enough reconnaissance to feel comfortable committing to fixed infrastructure before deployment.

What should defenders do now?

• Hunt for unsigned or recently signed kernel drivers loading from non-standard paths. Microsoft's vulnerable driver blocklist should be enforced in block mode, not left in audit.
• Filter outbound TCP and UDP from server segments. Hard-coded C2 is brittle; block the IPs and the implant goes silent.
• Check any Linux-side SprySOCKS indicators from prior reporting against Windows endpoints. Operators recycle infrastructure.

No breach notifications have been filed in connection with the Windows variants. That will likely change.

The detail worth watching isn't the Windows port itself. It's how quickly the driver component matures. Kernel-level implants that start rough tend to get refined, and Earth Lusca has the resources to do that refinement quietly.