FishMonger — Threat Actor Profile, Campaigns & Targets

Related Threat Clusters

• Webworm APT Expands Operations to Europe with New Backdoors

  The China-aligned APT group Webworm has shifted its focus from Asia to Europe, targeting government organizations in Belgium, Italy, Poland, Serbia, and Spain during 2025. ESET researchers identified new backdoors,…

  12 articles · Updated May 20, 2026
• FishMonger Expands SprySOCKS Malware to Windows with Kernel-Level Stealth

  ESET researchers have identified two new Windows variants of the SprySOCKS backdoor, previously exclusive to Linux, attributed to the Chinese cyberespionage group FishMonger. The variants, labeled WIN_DRV and WIN_PLUS,…

  12 articles · Updated June 16, 2026

Recent Intelligence Reports

• Fishmongers Arsenal Upgraded Sprysocks Windows — www.welivesecurity.com · June 19, 2026
• SprySOCKS backdoor expands to Windows with new variants — Feeds.Feedburner · June 16, 2026
• SprySOCKS Windows Variant Abuses Kernel Drivers to Evade Detection — Darkreading · June 16, 2026
• ESET Research: China-aligned FishMonger updates its arsenal, targets governments in ... — Markets.Businessinsider · June 16, 2026
• Windows version of SprySOCKS Linux malware used to attack govt orgs — Bleepingcomputer · June 16, 2026
• Webworm: New burrowing techniques — Welivesecurity · May 20, 2026

Related Entities