Tuesday, May 6, 2025
HomeCyber Security NewsFamousSparrow - New Hackers Group Attack Hotels, Governments by Leveraging MS...

FamousSparrow – New Hackers Group Attack Hotels, Governments by Leveraging MS Exchange Bugs

Published on

SIEM as a Service

Follow Us on Google News

 

The security firm, ESET has recently identified a new cyberespionage group, and it has been named “FamousSparrow” which indicates the protagonist of the Pirates of the Caribbean saga.

This group would have had hotels among its priority attacks, although it could also have attacked many other private companies, which include governments in Europe, the Middle East, America, Asia, and Africa. 

- Advertisement - Google News

But the most surprising discovery is that this cyber attack group has not targeted any US organizations.

FamousSparrow

The FamousSparrow group uses two custom versions of Mimikatz, the researchers noted during their investigation, and these customs were specifically being used to connect different conflicts to this group.

The FamousSparrow cyberattack group is a separate entity, but in the end, they came to know that they are linked with many other APT groups

There are many cases that are related to this group, however, in one case, the threat actor extended a variant of Motnug which is a loader managed by SparklingGoblin. 

Victimology

However, on the completion of the investigation, the experts came to know that this group has been active since at least August 2019, and are targetting different hotel chains.

Apart from this, there are some other targets too like international organizations, engineering companies, law firms from different companies that we have mentioned below:-

  • Brazil
  • Burkina Faso
  • South Africa
  • Canada
  • Israel
  • France
  • Guatemala
  • Lithuania
  • Saudi Arabia
  • Taiwan
  • Thailand
  • United Kingdom

Custom Espionage Tools Used?

Here we have mentioned all the custom tools deployed by the threat actors, which are mentioned below:-

  • A Mimikatz variant
  • A small utility that drops ProcDump on disk and uses it to dump the lsass process, probably in order to gather in-memory secrets, such as credentials
  • Nbtscan, a NetBIOS scanner
  • A loader for the SparrowDoor backdoor

SparrowDoor

The SparrowDoor is originally loaded through DLL search order hijacking, just by utilizing three elements that is a legitimate K7 Computing executable (Indexer.exe) specifically used as the DLL hijacking host, a malicious DLL (K7UI.dll), and an encrypted shellcode (MpSvc.dll). 

However, SparrowDoor is generally amidst with the -i command-line argument:-

Apart from this, the group exploited vulnerabilities in Microsoft Exchange known as ProxyLogon, and they stated about it in their report. 

Not only this but the data that has been collected through investigation implies that the threat actors of this group have begun exploiting the vulnerabilities on March 3, 2021, the day after the patches were released.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity updates.

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

BFDOOR Malware Targets Organizations to Establish Long-Term Persistence

The BPFDoor malware has emerged as a significant threat targeting domestic and international organizations,...

Uncovering the Security Risks of Data Exposure in AI-Powered Tools like Snowflake’s CORTEX

As artificial intelligence continues to reshape the technological landscape, tools like Snowflake’s CORTEX Search...

UNC3944 Hackers Shift from SIM Swapping to Ransomware and Data Extortion

UNC3944, a financially-motivated threat actor also linked to the group known as Scattered Spider,...

Over 2,800 Hacked Websites Targeting MacOS Users with AMOS Stealer Malware

Cybersecurity researcher has uncovered a massive malware campaign targeting MacOS users through approximately 2,800...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

BFDOOR Malware Targets Organizations to Establish Long-Term Persistence

The BPFDoor malware has emerged as a significant threat targeting domestic and international organizations,...

Uncovering the Security Risks of Data Exposure in AI-Powered Tools like Snowflake’s CORTEX

As artificial intelligence continues to reshape the technological landscape, tools like Snowflake’s CORTEX Search...

UNC3944 Hackers Shift from SIM Swapping to Ransomware and Data Extortion

UNC3944, a financially-motivated threat actor also linked to the group known as Scattered Spider,...