Chinese Hacker Group ‘FamousSparrow’ Resurfaces

The FamousSparrow hacking group, thought to be inactive since 2022, has re-emerged, targeting organizations in the U.S., Mexico, and Honduras, according to ESET researchers.

Investigating a cyberattack on a U.S. trade group, ESET discovered upgraded versions of the group’s SparrowDoor backdoor malware. Despite modifications, it was traced back to earlier versions.

Active since 2019, FamousSparrow has targeted hotels, governments, and international organizations across multiple countries. Recent attacks exploited outdated Windows Server and Microsoft Exchange vulnerabilities.

Using custom malware and Chinese cyber tools like ShadowPad, the group can steal data, monitor activity, and execute commands remotely.

FamousSparrow was also one of the first to exploit Microsoft Exchange’s ProxyLogon flaw in 2021. With its reappearance and enhanced tools, it remains a serious cyber threat.