New FamousSparrow Malware Targets Hotels and Engineering Firms with Custom Backdoor

ESET researchers have uncovered new activity from the China-aligned APT group FamousSparrow, revealing two previously undocumented versions of their custom SparrowDoor backdoor.

The group, thought to be inactive since 2022, compromised a US-based trade organization in the financial sector and a Mexican research institute in July 2024.

The first variant closely resembles the CrowDoor malware attributed to Earth Estries, while the second introduces a modular architecture.

Both versions demonstrate significant advancements in code quality and implement command parallelization, allowing for simultaneous execution of time-consuming operations.

Expanded Toolkit and Infrastructure

FamousSparrow’s arsenal now includes ShadowPad, a privately sold backdoor typically associated with China-aligned threat actors.

The group utilized a mix of custom and publicly available tools, including PowerHub for post-exploitation and BadPotato for privilege escalation.

The attackers initially deployed an ASHX webshell on compromised IIS servers, likely exploiting vulnerabilities in outdated Windows Server and Microsoft Exchange installations.

They then established interactive PowerShell sessions for reconnaissance and further payload deployment.

SparrowDoor’s evolution includes enhanced persistence mechanisms, utilizing both registry Run keys and Windows services.

The backdoor implements sophisticated network communication, using custom socket classes and RC4 encryption for data transmission.

This campaign marks the first observed use of ShadowPad by FamousSparrow, potentially indicating an expansion of their capabilities.

The group’s targets have diversified beyond the hospitality sector to include governments, international organizations, and engineering firms.

ESET researchers note potential overlaps between FamousSparrow and other threat actors like Earth Estries and GhostEmperor.

However, they maintain that FamousSparrow represents a distinct cluster with loose connections to these groups.

The discovery of this recent activity suggests that FamousSparrow has been continuously active and developing its toolset since 2022.

As the threat landscape evolves, organizations in targeted sectors should remain vigilant and implement robust security measures to defend against these sophisticated attacks.

Are you from SOC/DFIR Teams? – Analyse Malware, Phishing Incidents & get live Access with ANY.RUN -> Start Now for Free. 

Keep your files stored safely and securely with the SanDisk 2TB Extreme Portable SSD. With over 69,505 ratings and an impressive 4.6 out of 5 stars, this product has been purchased over 8K+ times in the past month. At only $129.99, this Amazon’s Choice product is a must-have for secure file storage.

Help keep private content private with the included password protection featuring 256-bit AES hardware encryption. Order now for just $129.99 on Amazon!

Help Power Techcratic’s Future – Scan To Support

If Techcratic’s content and insights have helped you, consider giving back by supporting the platform with crypto. Every contribution makes a difference, whether it’s for high-quality content, server maintenance, or future updates. Techcratic is constantly evolving, and your support helps drive that progress.

As a solo operator who wears all the hats, creating content, managing the tech, and running the site, your support allows me to stay focused on delivering valuable resources. Your support keeps everything running smoothly and enables me to continue creating the content you love. I’m deeply grateful for your support, it truly means the world to me! Thank you!