Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
4 IOCs
Fishmonger’s Arsenal Upgraded: Sprysocks for Windows
Threat Actors
Malware Families
Excerpt
https://www.welivesecurity.com/en/eset-research/fishmongers-arsenal-upgraded-sprysocks-windows/ FishMonger’s arsenal upgraded: SprySOCKS for Windows By ESET Research Archived: 2026-10-25 02:31:03 UTC ESET researchers have discovered two as-yet undocumented Windows variants of SprySOCKS, a previously Linux-only backdoor reportedly used by FishMonger, the group believed to be operated by a Chinese contractor named I‑SOON. While we initially discovered the malware samples on…
Read the original report →Diamond Model
Adversary(7)
Infrastructure(3)
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →4 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA1 | ffc3aa7909d4e72c360d65a1f45260dffe5c99b7 | High | Score 67/100 | First seen |
| Domain | klelam00007.zip | High | Score 67/100 | First seen |
| IP | 207.148.75.122 | High | Score 68/100 | First seen |
| IP | 207.148.78.36 | High | Score 61/100 | First seen |
IOC Relationship Graph
Building graph…