ESET found Windows variants of the SprySOCKS backdoor used in attacks against government organizations in Taiwan, Thailand, Pakistan, and Honduras, and attributed the activity to Earth Lusca. The malware adds kernel-level stealth, multiple persistence methods, and TCP traffic diversion, with possible links to a UEFI bootkit component tied to CVE-2023-24932. #SprySOCKS #EarthLusca #FishMonger #AquaticPanda #RedDev10 #TAG22 #CVE202324932 #BlackLotus

Earth Lusca (aka FishMonger) is a China-linked threat actor active since 2019 that conducts long‑term cyber-espionage against government, media, telecommunications, academic, and religious organizations while also running financially motivated campaigns against cryptocurrency platforms. Recent campaigns show expanded tooling and tradecraft — including the new Go-based, multi-platform backdoor KTLVdoor, extensive use of ShadowPad/Winnti toolsets, and a large, cloud-hosted, rotating C2 infrastructure to maintain stealth. #EarthLusca #KTLVdoor

A lawsuit casts light on the ecosystem of IT companies related to Chengdu 404, the company allegedly behind Chinese state-sponsored hacking group APT41.