Loading malware…
SparrowDoor is a custom Windows backdoor associated exclusively with the China-aligned cyberespionage group FamousSparrow. First publicly documented in 2021, it remained the group’s principal implant through multiple revised and modular versions before being largely replaced by SparroWocky from August 2025. FamousSparrow used SparrowDoor in espionage intrusions affecting organizations including government entities, a Mexican research institute, and a U.S. financial-sector trade group. Observed deployments use DLL side-loading through legitimate executables, with encrypted payloads loaded into memory. Documented functionality includes interactive command-shell access, file operations and listing, drive enumeration, proxying, network-configuration changes, persistence relaunch, and self-uninstallation. Variants have used Windows services or Registry Run keys for persistence, process hollowing, RC4-encrypted communications or payloads, and in-memory plugins. SparrowDoor lineage and its use to deploy SparroWocky have been key evidence supporting attribution of related operations to FamousSparrow.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
ESET first publicly documented FamousSparrow in September 2021 when it observed the group exploiting the ProxyLogon vulnerability.
4 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Since at least August 2025, the threat actor has deployed SparroWocky, a new custom backdoor that rapidly replaced SparrowDoor as the group's primary implant.
Chinese state-sponsored group TAG-141 (FamousSparrow) deployed SparrowDoor malware against Mexico's Universidad Nacional Autónoma in early 2025
This attack chain was attempting to load the Crowdoor loader, which is half-named after the SparrowDoor backdoor, detailed by ESET... Also, the command-line argument “2” found in a variant related to Tropic Trooper samples is very similar to SparrowDoor “-k” switch functionality.
CrowDoor is a variant of SparrowDoor, another backdoor attributed to FamousSparrow.
36 distinct techniques documented for this family, organized by ATT&CK tactic.
Listed in both FamousSparrow ATT&CK matrices. | Listed in both FamousSparrow ATT&CK matrices; the content identifies FamousSparrow C2/download infrastructure.
Listed in the SparroWocky and FamousSparrow ATT&CK tables. | Listed in the MITRE ATT&CK tables for SparroWocky and FamousSparrow.
ESET's experts found that the China-aligned cyberespionage outfit has hit its targets with two previously undocumented versions of their flagship backdoor called SparrowDoor. Importantly, the group was also observed using the ShadowPad backdoor for the first time.
When executed with the argument 11 , the backdoor launches the Windows color management tool ( colorcpl.exe ) with a command line argument of 22 and injects its loader into the newly created process.
Table 1. Command line arguments for SparrowDoor Argument Behavior ... 11 Process hollowing of colorcpl.exe .
Listed in the older FamousSparrow ATT&CK matrix; the artifact list includes encrypted shellcode and decrypted shellcode.
Listed in the later FamousSparrow ATT&CK matrix. | Listed in the 2024 FamousSparrow ATT&CK matrix.
Listed in the SparroWocky and 2024 FamousSparrow ATT&CK tables. | Listed in the ATT&CK matrices for SparroWocky and FamousSparrow.
Listed in the 2024 FamousSparrow ATT&CK matrix; artifacts include names such as WindowsUpdate.exe and taskhosk.exe. | Listed in the later FamousSparrow ATT&CK matrix.
When executed with the argument 11 , the backdoor launches the Windows color management tool ( colorcpl.exe ) with a command line argument of 22 and injects its loader into the newly created process.
Table 1. Command line arguments for SparrowDoor Argument Behavior ... 11 Process hollowing of colorcpl.exe .
Listed in the SparroWocky and 2024 FamousSparrow ATT&CK tables. | Listed in the ATT&CK matrices for SparroWocky and FamousSparrow.
Listed in the ATT&CK matrices for SparroWocky and FamousSparrow. | Listed in the SparroWocky and 2024 FamousSparrow ATT&CK tables.
Listed in the SparroWocky and 2024 FamousSparrow ATT&CK tables; the older FamousSparrow artifacts include encrypted and decrypted shellcode. | Listed in the ATT&CK matrices for SparroWocky and FamousSparrow.
MITRE ATT&CK techniques ... SparrowDoor launches the process into which it injects the loader, with its window hidden.
Listed in the ATT&CK matrices for SparroWocky and FamousSparrow.
Listed in all three ATT&CK technique tables. | Listed in all three ATT&CK matrices.
The resulting plaintext is the C&C server configuration, which consists of three pairs of addresses and ports... After loading this configuration, the backdoor will try to connect to the first server... then the next server, and so on.
Listed in both FamousSparrow ATT&CK matrices; C2 and download servers are identified for FamousSparrow, SparrowDoor, and ShadowPad. | Listed in both FamousSparrow ATT&CK matrices.
Listed in the SparroWocky and 2024 FamousSparrow ATT&CK tables. | Listed in the ATT&CK matrices for SparroWocky and FamousSparrow.
18 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
24 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A custom FamousSparrow backdoor and the group's historical signature malware. The content states that FamousSparrow is its only known user and that it was superseded as the primary implant by SparroWocky.
An older FamousSparrow backdoor implant that SparroWocky replaced as the group's principal implant. The content states that it shared some functionality and concepts with SparroWocky, but does not provide further technical detail.
A backdoor exclusive to FamousSparrow that was used to initially deploy SparroWocky; SparroWocky is described as its replacement.
FamousSparrow's prior long-running implant, used to deliver early SparroWocky infections. The content distinguishes SparroWocky as a separate malware family rather than a SparrowDoor variant.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.