Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
3 IOCs
FishMonger Uses TCP, UDP, and WebSocket C2 Channels in SprySOCKS Windows Attacks
Threat Actors
Excerpt
A major shift in the tactics of FishMonger, a Chinese cyberespionage group linked to the contractor I-SOON. The threat actors have developed two previously undocumented Windows versions of SprySOCKS, a backdoor previously thought to only target Linux systems . Telemetry data from 2023 and 2024 reveals that these new attacks primarily target government organizations across Honduras, Taiwan, Thailand, and Pakistan. The attackers likely gain initial access by exploiting known…
Read the original report →Diamond Model
Adversary(1)
Infrastructure
Capability
Victim
Attack Flow8 steps · MITRE ATT&CK mapped
Indicators of Compromise
Open the mindmap →3 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| CVE | CVE-2023-24932 | Medium | Score 51/100 | First seen |
| SHA1 | 955bfc3dcc867256f9f46a606deb0779fa3416d8 | Medium | Score 53/100 | First seen |
| SHA1 | 44dc4a08c5eb0972c8e18b0e01284e06f09006bb | Medium | Score 53/100 | First seen |
IOC Relationship Graph
Building graph…