You will always remember this as the day you finally caught FamousSparrow
Essential information
- Published
- 26/03/2025 20:15
- Modified
- 26/03/2025 20:51
- Tags
- 2025-03-26 hemigate modular malware shadowpad sparrowdoor
- Related entities
- 12 observables, 1 intrusion sets (apt), 21 techniques (mitre), 3 malware, 5 others
Description
ESET researchers uncovered new activity by the FamousSparrow APT group, including two undocumented versions of their SparrowDoor backdoor. The group compromised a US financial sector trade group and a Mexican research institute in July 2024. The new SparrowDoor versions show significant improvements in code quality and architecture, implementing command parallelization. FamousSparrow also used the ShadowPad backdoor for the first time. The analysis revealed links between FamousSparrow and other China-aligned threat actors like Earth Estries. The group's continued development of tools during a period of apparent inactivity suggests they remained active but undetected from 2022 to 2024.