New FamousSparrow Malware Targets Hotels and Engineering Firms with Custom Backdoor

ESET researchers identified renewed activity from the China-aligned APT FamousSparrow in July 2024, revealing two new SparrowDoor backdoor variants and the group’s first observed use of ShadowPad; the campaign used ASHX webshells, PowerShell sessions, privilege escalation and enhanced persistence, and the malware demonstrates modular design, RC4-encrypted communications and parallelized command execution, affecting organizations in finance, research and other sectors.