FamousSparrow APT Group Flocks to Hotels, Governments, Businesses

The cyber espionage group has a custom backdoor and has added the ProxyLogon Microsoft Exchange flaw to its toolkit.

A cyberespionage group dubbed FamousSparrow is targeting hotels, governments, and private businesses around the world, leveraging the ProxyLogon Microsoft Exchange Server vulnerability along with its own custom backdoor, SparrowDoor.
ESET researchers tracking the group believe it has been active since 2019, when it compromised an organization in Africa, says ESET researcher Matthieu Faou, who uncovered FamousSparrow with his colleague Tahseen Bin Taj. On March 3, the attackers began to exploit the ProxyLogon vulnerabilities that have been used by more than 10 advanced persistent threat (APT) groups to
take over Exchange servers
.
FamousSparrow primarily targets hotels; however, researchers have seen a few targets in other sectors, including governments, international organizations, engineering companies, and law firms. Its victims are located in countries including Brazil, Burkina Faso, South Africa, Canada, Israel, France, Lithuania, Guatemala, Saudi Arabia, Taiwan, Thailand, and the United Kingdom.
On the malware side, the group did not evolve much, but in terms of targeting, we have seen a shift in 2020 when they started to target hotels worldwide, says Faou of the groups evolution. FamousSparrow stands out for its focus on hotels, in addition to popular APT targets, such as governments.
We believe their main motivation is espionage, he adds. Hotels are prime targets for APT groups because it allows attackers to gather data about their targets travel habits. They can also potentially breach the hotels Wi-Fi infrastructure to spy on nonencrypted network traffic.
Microsoft Exchange in the Mix
In cases where researchers were able to determine the initial compromise vector, they say FamousSparrow targeted victims through vulnerable Internet-facing applications. Its believed the group exploited known remote code execution flaws in Microsoft Exchange, including the ProxyLogon bug in March, as well as Microsoft SharePoint and Oracle Opera, a form of business software for hotel management.
With the server compromised, the attackers deploy several custom tools: a variant of Mimikatz, NetBIOS scanner Nbtscan, and a small utility that drops ProcDump on disk, which drops another process that researchers say is likely used to gather in-memory secrets, such as credentials.
Attackers also dropped a loader for their SparrowDoor backdoor, a tool that is unique to them.
SparrowDoor enables attackers to [almost] fully control the compromised machines, including executing any arbitrary command or exfiltrating any file, Faou says. The deployment of SparrowDoor, as well as the use of server-side vulnerabilities, is the groups main trait.
Researchers consider
FamousSparrow to be its own entity but have found connections to other known APT groups, including SparklingGoblin and DRBControl.
It is likely they share tools or access to victims, but we believe they are separate threat groups, Faou says.
This is a reminder for organizations to patch Internet-facing applications quickly, researchers say. If quick patching is not possible, businesses are advised to not expose the apps to the Internet.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
FamousSparrow APT Group Flocks to Hotels, Governments, Businesses