kyber.today

daily cyber × ai intelligence

← threat actors

threat actor · CN

Earth Lusca

also tracked as fishmonger 5

5 stories · 5 in the wild · June 17, 2026 – June 21, 2026

evidence: 5 observed

sectors

  • government 4 · Jun 21

geography

  • china 4 · Jun 21
  • honduras 3 · Jun 21
  • pakistan 3 · Jun 21
  • taiwan 3 · Jun 21
  • thailand 3 · Jun 21

malware and tools

  • sprysocks 5 · Jun 21
  • win drv 2 · Jun 18
  • win plus 2 · Jun 18

techniques

  • command and control 2 · Jun 21
  • persistence 2 · Jun 21
  • kernel driver 2 · Jun 19
  • backdoor 1 · Jun 19
  • bootkit 1 · Jun 17
  • rootkit 1 · Jun 17

attack phases seen

  • Persistence 5 · Jun 21
  • Command and control 2 · Jun 21
  • Defense evasion 2 · Jun 19

what we reported, newest first, grouped by story

Jun 17 – June 21, 2026 · 5 reports

  • ESET uncovered two undocumented Windows variants of the SprySOCKS backdoor (WIN_DRV and WIN_PLUS), attributed with high confidence to China-nexus FishMonger and used against governments in Honduras, Taiwan, Thailand, and Pakistan. WIN_DRV weaponizes a kernel driver to redirect traffic to a hidden TCP port triggered by crafted packet data, with possible UEFI bootkit involvement (WeLiveSecurity, The Hacker News). · Jun 21 · observed · as fishmonger · Threat Intelligence
  • ESET attributed two undocumented Windows variants of the previously Linux-only SprySOCKS backdoor (WIN_DRV, WIN_PLUS) to China-nexus FishMonger; WIN_DRV weaponizes a kernel driver for a passive, hidden-port TCP backdoor triggered by crafted packets, used against governments in Honduras, Taiwan, Thailand, and Pakistan. The Hacker News, WeLiveSecurity · Jun 20 · observed · as fishmonger · Threat Intelligence & Espionage
  • ESET attributed two undocumented Windows variants of the SprySOCKS backdoor (WIN_DRV, WIN_PLUS) to China-nexus FishMonger, with a kernel driver redirecting traffic to a hidden passive TCP backdoor for stealth against government targets (WeLiveSecurity, Dark Reading). · Jun 19 · observed · as fishmonger · Nation-State & APT
  • SprySOCKS — ESET attributes two undocumented Windows variants (WIN_PLUS, WIN_DRV) of the previously Linux-only backdoor to China-nexus FishMonger (Earth Lusca). WIN_DRV weaponizes a kernel driver to redirect traffic to a hidden passive TCP backdoor, with possible UEFI bootkit involvement. IOCs published (WeLiveSecurity, The Hacker News). · Jun 18 · observed · as fishmonger · Threat Activity & Ransomware
  • SprySOCKS (China-linked FishMonger) expanded from Linux to Windows with two new variants — WIN_DRV and WIN_PLUS — featuring kernel-driver rootkit capabilities and possible UEFI bootkit involvement, hitting government targets in Honduras, Taiwan, Thailand, and Pakistan. ESET attributes with high confidence. ESET/WeLiveSecurity, The Hacker News. · Jun 17 · observed · as fishmonger · Threat Activity