Sunday, July 21, 2024

FamousSparrow – New Hackers Group Attack Hotels, Governments by Leveraging MS Exchange Bugs


The security firm, ESET has recently identified a new cyberespionage group, and it has been named “FamousSparrow” which indicates the protagonist of the Pirates of the Caribbean saga.

This group would have had hotels among its priority attacks, although it could also have attacked many other private companies, which include governments in Europe, the Middle East, America, Asia, and Africa. 

But the most surprising discovery is that this cyber attack group has not targeted any US organizations.


The FamousSparrow group uses two custom versions of Mimikatz, the researchers noted during their investigation, and these customs were specifically being used to connect different conflicts to this group.

The FamousSparrow cyberattack group is a separate entity, but in the end, they came to know that they are linked with many other APT groups

There are many cases that are related to this group, however, in one case, the threat actor extended a variant of Motnug which is a loader managed by SparklingGoblin. 


However, on the completion of the investigation, the experts came to know that this group has been active since at least August 2019, and are targetting different hotel chains.

Apart from this, there are some other targets too like international organizations, engineering companies, law firms from different companies that we have mentioned below:-

  • Brazil
  • Burkina Faso
  • South Africa
  • Canada
  • Israel
  • France
  • Guatemala
  • Lithuania
  • Saudi Arabia
  • Taiwan
  • Thailand
  • United Kingdom

Custom Espionage Tools Used?

Here we have mentioned all the custom tools deployed by the threat actors, which are mentioned below:-

  • A Mimikatz variant
  • A small utility that drops ProcDump on disk and uses it to dump the lsass process, probably in order to gather in-memory secrets, such as credentials
  • Nbtscan, a NetBIOS scanner
  • A loader for the SparrowDoor backdoor


The SparrowDoor is originally loaded through DLL search order hijacking, just by utilizing three elements that is a legitimate K7 Computing executable (Indexer.exe) specifically used as the DLL hijacking host, a malicious DLL (K7UI.dll), and an encrypted shellcode (MpSvc.dll). 

However, SparrowDoor is generally amidst with the -i command-line argument:-

Apart from this, the group exploited vulnerabilities in Microsoft Exchange known as ProxyLogon, and they stated about it in their report. 

Not only this but the data that has been collected through investigation implies that the threat actors of this group have begun exploiting the vulnerabilities on March 3, 2021, the day after the patches were released.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity updates.


Latest articles

Hackers Claiming Dettol Data Breach: 453,646 users Impacted

A significant data breach has been reported by a threat actor known as 'Hana,'...

CrowdStrike Update Triggers Widespread Windows BSOD Crashes

A recent update from cybersecurity firm CrowdStrike has caused significant disruptions for Windows users,...

Operation Spincaster Disrupts Approval Phishing Technique that Drains Victim’s Wallets

Chainalysis has launched Operation Spincaster, an initiative to disrupt approval phishing scams that have...

Octo Tempest Know for Attacking VMWare ESXi Servers Added RansomHub & Qilin to Its Arsenal

Threat actors often attack VMware ESXi servers since they accommodate many virtual machines, which...

TAG-100 Actors Using Open-Source Tools To Attack Gov & Private Orgs

Hackers exploit open-source tools to execute attacks because they are readily available, well-documented, and...

macOS Users Beware Of Weaponized Meeting App From North Korean Hackers

Meeting apps are often targeted and turned into weapons by hackers as they are...

Hackers Exploiting Legitimate RMM Tools With BugSleep Malware

Since October 2023, MuddyWater, which is an Iranian threat group linked to MOIS, has...
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Free Webinar

Low Rate DDoS Attack

9 of 10 sites on the AppTrana network have faced a DDoS attack in the last 30 days.
Some DDoS attacks could readily be blocked by rate-limiting, IP reputation checks and other basic mitigation methods.
More than 50% of the DDoS attacks are employing botnets to send slow DDoS attacks where millions of IPs are being employed to send one or two requests per minute..
Key takeaways include:

  • The mechanics of a low-DDoS attack
  • Fundamentals of behavioural AI and rate-limiting
  • Surgical mitigation actions to minimize false positives
  • Role of managed services in DDoS monitoring

Related Articles