Full Report
A China-linked cyberespionage group known as 'FamousSparrow' was observed using a new modular version of its signature backdoor 'SparrowDoor' against a US-based trade organization. [...]
Analysis Summary
# Threat Actor: FamousSparrow
## Attribution & Identity
FamousSparrow is identified as a Chinese threat actor. ESET notes potential, though unconfirmed, linkages by Microsoft, which groups FamousSparrow, GhostEmperor, and Earth Estries under the "Salt Typhoon" cluster. ESET tracks them as distinct due to a lack of direct technical evidence supporting the Microsoft grouping, suggesting possible infrastructure reuse and tool overlap due to a shared third-party supplier or "digital quartermaster."
## Activity Summary
The article focuses on the deployment of an upgraded, modular malware variant being used by FamousSparrow. This variant shows significant technical evolution, allowing for better stealth and expanded capabilities through a plugin-based architecture. The group has also been observed using the high-tier ShadowPad RAT.
## Tactics, Techniques & Procedures
- **Modular Backdoor:** Utilizes a modular backdoor featuring a plugin-based architecture capable of loading new plugins entirely in memory at runtime for evasiveness.
- **Parallelized Execution:** Parallelizes time-consuming commands (like file I/O and interactive shell tasks) to handle new commands concurrently.
- **DLL Side-loading:** Uses DLL side-loading via a renamed Microsoft Office IME executable to load the ShadowPad RAT.
- **Process Injection:** Injects the ShadowPad module into the Windows Media Player process (`wmplayer.exe`).
- **Operation Capabilities (via plugins):** Shell access, file system manipulation, keylogging, proxying, screenshot capturing, file transfer, and process listing/killing.
## Targeting
- Sectors: Not explicitly mentioned in the provided text beyond the general nature of state-sponsored activity typical of Chinese actors.
- Geography: Not explicitly mentioned.
- Victims: No specific victim organizations are detailed in the provided text.
## Tools & Infrastructure
- **Malware families used:**
- Upgraded, proprietary modular backdoor.
- ShadowPad (a versatile modular remote access trojan/RAT).
- **Infrastructure (C2, domains, IPs - defang URLs):**
- Connects to a known C2 server associated with the ShadowPad RAT. (No specific domains/IPs found in the text).
## Implications
FamousSparrow is actively upgrading its operational capabilities, moving toward a highly modular and evasive malware design that operates largely in memory. Their adoption of high-tier tools like ShadowPad, typically associated with other major Chinese APTs, suggests potential access to advanced cyber capabilities, possibly sourced via a shared supply chain actor ("digital quartermaster").
## Mitigations
- Implement robust endpoint detection and response capable of detecting in-memory loading techniques and process injection (e.g., into `wmplayer.exe`).
- Monitor for anomalous activity related to newly loaded DLLs or plugins executing within legitimate processes.
- Investigate potential links or overlaps with TTPs/infrastructure associated with known groups like GhostEmperor or Earth Estries, recognizing the possibility of a common third-party tool supplier.