MalwarePublished 16 Jun 2026

Windows version of SprySOCKS Linux malware used to attack govt orgs

Source Bleeping Computer

Mentions 1 CVE

Mentioned vulnerabilities

CVE-2023-24932

Description

Windows variants for the SprySOCKS Linux malware have been used in attacks targeting government organizations in at least four countries. [...]

Impact

The malware enables attackers to maintain stealthy, persistent access to compromised Windows systems, including government organizations, with capabilities for system reconnaissance, file manipulation, keylogging, and proxying network traffic. The kernel-level rootkit features allow hiding of malware artifacts and network communications, complicating detection and forensic analysis. The TCP traffic diversion feature conceals backdoor communication ports, further evading network-based detection. Potential UEFI bootkit exploitation could enable persistence below the OS level, increasing difficulty of removal. These capabilities facilitate espionage and long-term access to sensitive government networks.

Defensive guidance

Mitigation should focus on detection and removal using updated endpoint security solutions capable of identifying kernel-level rootkits and backdoors. Monitoring for indicators of compromise provided by ESET's report is recommended. Organizations should apply best practices for endpoint protection, including restricting driver installation to trusted sources and monitoring scheduled tasks and IFEO entries for suspicious activity. Since this is malware, vendor-managed patching does not apply. Patch status is not applicable; check vendor advisories and security vendor updates for detection signatures and removal tools.

References

bleepingcomputer.com/news/security/windows-version-of-sprysocks-linux-malware-used-to-attack-govt-orgs/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 16 Jun 2026, 09:30 UTC

References

Community reviews

Related threats