China-Linked SprySOCKS Backdoor Expands to Windows with Driver-Based Stealth

Chinese-linked threat actors have upgraded their SprySOCKS backdoor malware to now target Windows systems, incorporating driver-based stealth techniques to avoid detection. The malware, which was previously focused on other platforms, now uses Windows drivers to hide its presence and maintain persistent access to compromised systems. This evolution represents a significant enhancement in the sophistication of Chinese cyber espionage capabilities, making the threat harder for security teams to identify and remove.