New FamousSparrow Malware Targets Motels and Engineering Companies with Customized Backdoor

ESET researchers have uncovered new exercise from the China-aligned APT group FamousSparrow, revealing two beforehand undocumented variations of their customized SparrowDoor backdoor.

The group, considered inactive since 2022, compromised a US-based commerce group within the monetary sector and a Mexican analysis institute in July 2024.

The primary variant intently resembles the CrowDoor malware attributed to Earth Estries, whereas the second introduces a modular structure.

Each variations display vital developments in code high quality and implement command parallelization, permitting for simultaneous execution of time-consuming operations.

Expanded Toolkit and Infrastructure

FamousSparrow’s arsenal now consists of ShadowPad, a privately offered backdoor usually related to China-aligned risk actors.

The group utilized a mixture of customized and publicly obtainable instruments, together with PowerHub for post-exploitation and BadPotato for privilege escalation.

The attackers initially deployed an ASHX webshell on compromised IIS servers, possible exploiting vulnerabilities in outdated Home windows Server and Microsoft Change installations.

They then established interactive PowerShell periods for reconnaissance and additional payload deployment.

SparrowDoor’s evolution consists of enhanced persistence mechanisms, using each registry Run keys and Home windows companies.

The backdoor implements refined community communication, utilizing customized socket courses and RC4 encryption for information transmission.

This marketing campaign marks the primary noticed use of ShadowPad by FamousSparrow, doubtlessly indicating an growth of their capabilities.

The group’s targets have diversified past the hospitality sector to incorporate governments, worldwide organizations, and engineering corporations.

ESET researchers observe potential overlaps between FamousSparrow and different risk actors like Earth Estries and GhostEmperor.

Nonetheless, they keep that FamousSparrow represents a definite cluster with free connections to those teams.

The invention of this current exercise means that FamousSparrow has been constantly energetic and creating its toolset since 2022.

Because the risk panorama evolves, organizations in focused sectors ought to stay vigilant and implement strong safety measures to defend in opposition to these refined assaults.

Are you from SOC/DFIR Groups? – Analyse Malware, Phishing Incidents & get stay Entry with ANY.RUN -> Begin Now for Free.