Chinese FamousSparrow hackers deploy upgraded malware in attacks

FamousSparrow, a China-linked cyber-espionage actor, has been observed deploying new, more advanced modular variants of its SparrowDoor backdoor and leveraging ShadowPad against multiple organizations (a US trade organization, a Mexican research institute, and a Honduran government institution). Researchers at ESET found initial access via exploitation of outdated Microsoft Exchange and Windows Server endpoints using webshells, and noted capabilities such as plugin-based in-memory modules, parallel command execution, DLL side-loading, keylogging, file operations, and stealthy C2 switching.