CVE-2023-24932: Microsoft Windows — Kernel Driver Backdoor Enables Stealth Espionage (June 2024)

CVE-2023-24932 — Microsoft Windows

CVE-2023-24932 is a high-severity Windows vulnerability enabling attackers to deploy kernel-level drivers for persistent, stealthy backdoor access. The flaw is being actively exploited by the China-linked FishMonger group, leveraging the SprySOCKS malware to target government organizations. No official CVSS score is published, but exploitation is confirmed in the wild.

Attack Vector

Attackers deliver a Windows variant of the SprySOCKS backdoor, previously seen only on Linux, using malicious kernel drivers to evade detection and maintain persistence. The malware collects system data, enumerates processes and services, executes arbitrary commands, and establishes covert command-and-control channels over multiple protocols. Evidence suggests possible use of a UEFI bootkit vulnerability to further entrench the malware at a low level, making removal and detection difficult. The campaign is ongoing and targets Windows systems in government environments.

Who Is at Risk

Confirmed targets include unnamed government organizations in Honduras, Taiwan, Thailand, and Pakistan. Any Windows deployment—especially in government or critical infrastructure—should be considered at risk if not patched. The attack leverages both kernel driver vulnerabilities and potential UEFI bootkit weaknesses, so systems with outdated drivers or insecure boot configurations are especially vulnerable.

Patch & Mitigate

• Patch: Apply the latest Microsoft security updates addressing CVE-2023-24932 immediately. Review and update all third-party drivers and firmware, especially on high-value assets.
• Workaround: Enable Secure Boot and restrict unsigned driver installation. Monitor for unauthorized driver loads.
• Detect: Audit for anomalous kernel driver loads, unexpected outbound connections, and system process enumeration. Look for persistence mechanisms in UEFI/bootloader regions and monitor for SprySOCKS-related indicators.

MITRE ATT&CK

• TA0005 — Defense Evasion: Use of kernel drivers and UEFI bootkits to bypass security controls and evade detection.
• TA0006 — Credential Access: Malware may harvest credentials via low-level system access.
• TA0011 — Command and Control: Establishes covert channels for remote control and data exfiltration.

Source: https://thehackernews.com/2026/06/china-linked-sprysocks-backdoor-expands.html