SprySOCKSMalware
Last reported yesterday, by The Hacker News3 reports
ATT&CK techniques
6 of 50 · each with the sentence it comes from- T1542.003Bootkit
“BlackX UEFI Bootkit Bypasses Secure Boot on Patched Windows Systems Missing Revocations”
- T1007System Service Discovery
“T1007”
- T1008Fallback Channels
“T1008”
- T1010Application Window Discovery
“T1010”
- T1014Rootkit
“T1014”
- T1027Obfuscated Files or Information
“Obfuscated Files or Information: Dynamic API Resolution”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
3 reports, newest first · the exact sentence from each-
BlackX UEFI Bootkit Bypasses Secure Boot on Patched Windows Systems Missing Revocations“BlackX's connections to APT41 stem from an ESET report in June 2026, which documented FishMonger's use of a Windows backdoor called SprySOCKS in attacks targeting government entities in Honduras, Taiwan, Thailand, and Pakistan between 2023 and 2024.”
-
Arsenal de FishMonger actualizado: SprySOCKS para Windows“Arsenal de FishMonger actualizado: SprySOCKS para Windows”
-
FishMonger’s arsenal upgraded: SprySOCKS for Windows“FishMonger’s arsenal upgraded: SprySOCKS for Windows”
Indicators in its reports
named in the reports above- ffc3aa7909d4e72c…60dffe5c99b7in 2 reports
- 207.148.78[.]36in 2 reports
- 207.148.75[.]122in 2 reports
- 955bfc3dcc867256…0779fa3416d8in 2 reports
- 44dc4a08c5eb0972…4e06f09006bbin 2 reports
- ab87b29b6f79487c…9001e536f083in 2 reports
- 6490b8e4aade25a3…2db2122470bcin 2 reports
- e7484c24b88a1a24…9a993670285bin 2 reports
- 621d1952839be4b0…e5062ca368edin 2 reports
- 2457eed2ab28e377…9dad2c8079d4in 2 reports
- d2c706b1eaf662bf…73ed84bda24ain 2 reports
Copy these 11 indicators · defanged
Thanks — we review every report.