Fishmonger
FishMonger is a China-linked cyberespionage threat actor active since at least 2019 and assessed to operate under the broader Winnti Group umbrella. The group is also tracked as Earth Lusca and has additionally been associated in the provided content with TAG-22, Aquatic Panda, and Red Dev 10. Multiple sources in the content assess that FishMonger is operated by the Chinese contractor I-SOON (also written iSoon), including ESET’s high-confidence attribution of Operation FishMedley to the group and its independent determination that FishMonger is operated by I-SOON. The actor primarily targets government entities and other organizations of strategic interest. Reported victims and targeting in the content include government organizations in Honduras, Taiwan, Thailand, and Pakistan during 2023–2024; universities in Hong Kong in 2020; and, in Operation FishMedley during 2022, governmental organizations, NGOs, a geopolitical think tank, a Catholic organization, and a Catholic charity in Taiwan, Hungary, Turkey, Thailand, the United States, and France. FishMonger is linked in the content to the SprySOCKS backdoor, including newly identified Windows variants after earlier Linux-only use. The Windows variants, WIN_DRV and WIN_PLUS, were used against government organizations and support command-and-control over TCP, UDP, and WebSocket with more than 30 commands for system discovery, process and service control, file management, SOCKS proxying, and keylogging. Reported stealth and persistence techniques include DLL side-loading, scheduled tasks, process doppelgänging into svchost.exe, abuse of the Windows Print Spooler via a print processor, and kernel-driver-based hiding of processes, files, registry keys, and network connections. The content also notes limited indications that some attacks may have involved a UEFI bootkit component possibly exploiting CVE-2023-24932. Beyond SprySOCKS, the group’s tooling in the provided content includes ShadowPad, Spyder, SodaMaster, RPipeCommander, Cobalt Strike, FunnySwitch, and BIOPASS RAT. In Operation FishMedley, operators used ShadowPad, SodaMaster, Spyder, and RPipeCommander, along with credential dumping, DLL side-loading, PowerShell, Impacket, LSASS dumping, SAM hive theft, Firefox credential theft, lateral movement, and likely data exfiltration via Dropbox tooling. The content also states FishMonger is known for watering-hole attacks. The provided material also notes overlaps or links between FishMonger and other China-aligned clusters, including Webworm, SixLittleMonkeys, and Space Pirates, and identifies FishMonger as one of several ShadowPad-using activity clusters tracked since 2017.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Who they target
Sectors the actor has been observed targeting.
- Government & Administration
Where they target
Geographies tied to known operations.
- 🇭🇳 Honduras
- 🇹🇼 Taiwan
- 🇹🇭 Thailand
- 🇵🇰 Pakistan
Where they're from
Attributed origin per open-source reporting.
- CN
Tradecraft
52 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
10 malware families attributed to this actor across reporting.
5 additional families tracked in Mallory.
Associated vulnerabilities
7 CVEs this actor has used in observed campaigns. 7 of them exploited in the wild.
ESET researchers also noted indications that some attacks may involve a UEFI bootkit component, possibly exploiting CVE-2023-24932, which could allow the malware to survive a complete operating system reinstall.
Details on Exploited Vulnerabilities ... CVE-2016-5195 Linux kernel 7.0
Details on Exploited Vulnerabilities ... CVE-2021-22555 Linux 7.8
Details on Exploited Vulnerabilities ... CVE-2022-21587 Oracle Web Applications 9.8
Details on Exploited Vulnerabilities ... CVE-2023-32315 Openfire 7.5
2 more CVEs tied to this actor tracked in Mallory.
Observables
37 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Chinese cyberespionage group expanding SprySOCKS from Linux to Windows, targeting primarily government entities and conducting espionage campaigns. The group is also known for watering-hole attacks and continued investment in stealth and persistence capabilities.
China-linked espionage activity cluster using newly documented Windows variants of SprySOCKS with kernel-driver stealth, passive TCP backdoor functionality, Print Spooler abuse, and likely targeting government organizations.
Linked to new Windows variants of the SprySOCKS backdoor and active targeting of government entities during 2023–2024.
Chinese espionage threat activity using upgraded Windows variants of the SprySocks backdoor for long-term intelligence gathering and data theft against government organizations.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.