Famous Sparrow

Famous Sparrow is a China-nexus advanced persistent threat group active since at least 2019 and associated with cyberespionage operations. The group has historically targeted hotels, governments, international organizations, law firms, and more recently telecommunications providers, including critical telecom infrastructure in South America. Cisco Talos has assessed with high confidence that the cluster it tracks as UAT-9244 is closely associated with Famous Sparrow, and reporting also notes overlap with Tropic Trooper. Famous Sparrow is associated with the SparrowDoor malware lineage, and newer activity linked to the group includes CrowDoor-derived tooling and the TernDoor Windows backdoor. Observed tradecraft includes DLL side-loading, in-memory payload execution, process injection into legitimate Windows processes, persistence via scheduled tasks and autorun mechanisms, and use of a malicious driver to suspend or terminate processes for defense evasion. TernDoor supports remote command execution, system information collection, and file manipulation. Linux and embedded-device targeting associated with the same activity includes the PeerTime backdoor, a multi-architecture ELF implant capable of operating on servers, routers, and other telecommunications-relevant systems. PeerTime uses BitTorrent-based peer communications for instruction retrieval and payload delivery, helping obscure attacker infrastructure and complicate detection. Associated operations also used BruteEntry, a Go-based scanner and credential brute-forcing utility that probes exposed services and can turn compromised edge devices into operational relay boxes for mass scanning and access expansion. Taken together, the group’s known operations indicate a focus on long-term persistent access, credential acquisition, and post-compromise control of strategically valuable networks for intelligence collection. Known associated designations and overlaps include UAT-9244, with tooling lineage tied to SparrowDoor and CrowDoor.