“SprySOCKS”, a new Linux backdoor, has been observed in Earth Lusca’s latest activity, involving the targeting of government agencies in various countries. Earth Lusca is a Chinese espionage-focused threat group that has been active in the first half of 2023, typically targeting “key government entities focused on foreign affairs, technology, and telecommunications in Southeast Asia, Central Asia, the Balkans, and worldwide.” Researchers noted that Earth Lusca has been recently targeting victim organizations’ public-facing servers by exploiting known n-day vulnerabilities, including Fortinet flaws (CVE-2022-40684 and CVE-2022-39952), Microsoft Exchange ProxyShell flaws (CVE-2021-34473, CVE-2021-34523v, and CVE-2021-31207), and more. Once the threat group infiltrates the victim’s networks through the server vulnerabilities, a web shell is deployed and Cobalt Strike is installed for lateral movement purposes. The group then exfiltrates documents and email account credentials, as well as deploys backdoors. Researchers detailed that SprySOCKS originates from the open-source Windows malware “Trochilus” but appears to be a mixture of different malware strains. “RedLeaves” (a Windows malware) is suspected to be involved due to the similarity in command-and-control (C2) communication protocols. SprySOCKS is also suspected to be derived from “Derusbi” (a Linux malware) due to the similarity in the implementations of the interactive shell in each malware. Researchers believe that SprySOCKS is currently under development and only used by Earth Lusca as of September 18, 2023. Additional technical details as well as indicators of compromise (IOCs) can be viewed in the report linked below.