Loading malware…
SparrowDoor is a Windows backdoor associated with the China-aligned cyberespionage group FamousSparrow. It has supported intrusions against hotels, government institutions, international organizations, engineering companies, law firms, financial-sector organizations, and research institutions worldwide. Deployments have followed exploitation of vulnerable internet-facing applications, including Microsoft Exchange through the ProxyLogon vulnerability chain.
SparrowDoor provides interactive reverse-shell access, host reconnaissance, file transfer and exfiltration, directory and file manipulation, and process termination. Later variants additionally support proxying, drive enumeration, network-configuration changes, and parallel command handling. A modular variant extends functionality through in-memory plugins. The backdoor communicates through encrypted command-and-control connections and can use proxies. It collects identifying information about compromised hosts and users and includes an uninstall function that removes its persistence mechanisms and associated files.
Its execution chain uses legitimate executables to side-load malicious DLLs that decrypt and load the backdoor. Observed variants employ encrypted payloads, reflective loading, and process hollowing. SparrowDoor establishes persistence through Windows services or registry Run entries and can enable the Windows debug privilege. These mechanisms support sustained remote access and concealment during post-compromise operations.
Two substantially revised variants identified during investigations of 2024 intrusions demonstrated continued development, including a modular architecture and improved command processing. Beginning in August 2025, FamousSparrow replaced SparrowDoor as its primary implant with SparroWocky, a distinct backdoor family. SparrowDoor was also used to deploy some early SparroWocky infections.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
4 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
In July 2025, ESET researchers observed FamousSparrow pivot to exclusively targeting government organizations in Latin America. To meet its new challenge, the following month, it ditched its namesake "SparrowDoor" backdoor for the aforementioned SparroWocky malware.
Chinese state-sponsored group TAG-141 (FamousSparrow) deployed SparrowDoor malware against Mexico's Universidad Nacional Autónoma in early 2025
This attack chain was attempting to load the Crowdoor loader, which is half-named after the SparrowDoor backdoor, detailed by ESET... Also, the command-line argument “2” found in a variant related to Tropic Trooper samples is very similar to SparrowDoor “-k” switch functionality.
CrowDoor is a variant of SparrowDoor, another backdoor attributed to FamousSparrow.
36 distinct techniques documented for this family, organized by ATT&CK tactic.
Listed in both FamousSparrow ATT&CK matrices. | Listed in both FamousSparrow ATT&CK matrices; the content identifies FamousSparrow C2/download infrastructure.
Listed in the SparroWocky and FamousSparrow ATT&CK tables. | Listed in the MITRE ATT&CK tables for SparroWocky and FamousSparrow.
Listed in the later FamousSparrow ATT&CK matrix. | Listed in the 2024 FamousSparrow ATT&CK matrix.
Listed in the SparroWocky and FamousSparrow ATT&CK tables. | Listed in the MITRE ATT&CK tables for SparroWocky and FamousSparrow.
Listed in all three ATT&CK matrices.
ESET's experts found that the China-aligned cyberespionage outfit has hit its targets with two previously undocumented versions of their flagship backdoor called SparrowDoor. Importantly, the group was also observed using the ShadowPad backdoor for the first time.
Listed in the ATT&CK matrices for SparroWocky and FamousSparrow.
Listed in the ATT&CK matrices for SparroWocky and FamousSparrow.
The earlier FamousSparrow matrix lists DLL Search Order Hijacking. | Listed in the older FamousSparrow ATT&CK matrix; the associated artifact list includes a legitimate K7 binary and a malicious loader DLL.
Listed in all three ATT&CK matrices. | Listed in all three ATT&CK technique tables.
Listed in all three ATT&CK technique tables. | Listed in all three ATT&CK matrices.
When executed with the argument 11 , the backdoor launches the Windows color management tool ( colorcpl.exe ) with a command line argument of 22 and injects its loader into the newly created process.
Table 1. Command line arguments for SparrowDoor Argument Behavior ... 11 Process hollowing of colorcpl.exe .
Listed in all three ATT&CK matrices. | Listed in all three ATT&CK technique tables.
Listed in all three ATT&CK technique tables. | Listed in all three ATT&CK matrices.
Listed in the older FamousSparrow ATT&CK matrix; the artifact list includes encrypted shellcode and decrypted shellcode.
Listed in the later FamousSparrow ATT&CK matrix. | Listed in the 2024 FamousSparrow ATT&CK matrix.
Listed in the 2024 FamousSparrow ATT&CK matrix.
Listed in the SparroWocky and 2024 FamousSparrow ATT&CK tables. | Listed in the ATT&CK matrices for SparroWocky and FamousSparrow.
Listed in the 2024 FamousSparrow ATT&CK matrix; artifacts include names such as WindowsUpdate.exe and taskhosk.exe. | Listed in the later FamousSparrow ATT&CK matrix.
When executed with the argument 11 , the backdoor launches the Windows color management tool ( colorcpl.exe ) with a command line argument of 22 and injects its loader into the newly created process.
Table 1. Command line arguments for SparrowDoor Argument Behavior ... 11 Process hollowing of colorcpl.exe .
Listed in the SparroWocky and 2024 FamousSparrow ATT&CK tables. | Listed in the ATT&CK matrices for SparroWocky and FamousSparrow.
Listed in the ATT&CK matrices for SparroWocky and FamousSparrow. | Listed in the SparroWocky and 2024 FamousSparrow ATT&CK tables.
Listed in the SparroWocky and 2024 FamousSparrow ATT&CK tables; the older FamousSparrow artifacts include encrypted and decrypted shellcode. | Listed in the ATT&CK matrices for SparroWocky and FamousSparrow.
MITRE ATT&CK techniques ... SparrowDoor launches the process into which it injects the loader, with its window hidden.
The earlier FamousSparrow matrix lists DLL Search Order Hijacking. | Listed in the older FamousSparrow ATT&CK matrix; the associated artifact list includes a legitimate K7 binary and a malicious loader DLL.
Listed in the SparroWocky and 2024 FamousSparrow ATT&CK tables. | Listed in the ATT&CK matrices for SparroWocky and FamousSparrow.
Listed in the ATT&CK matrices for SparroWocky and FamousSparrow.
Listed in all three ATT&CK technique tables. | Listed in all three ATT&CK matrices.
Listed in all three ATT&CK matrices. | Listed in all three ATT&CK technique tables.
Information about the host machine is sent automatically after the initial connection message and includes a list of installed security products in addition to what was sent in previous versions.
MITRE ATT&CK techniques ... FamousSparrow transferred SparrowDoor to other machines on the network.
Listed in all three ATT&CK matrices. | Listed in all three ATT&CK technique tables.
The resulting plaintext is the C&C server configuration, which consists of three pairs of addresses and ports... After loading this configuration, the backdoor will try to connect to the first server... then the next server, and so on.
Listed in both FamousSparrow ATT&CK matrices; C2 and download servers are identified for FamousSparrow, SparrowDoor, and ShadowPad. | Listed in both FamousSparrow ATT&CK matrices.
Listed in the SparroWocky and 2024 FamousSparrow ATT&CK tables. | Listed in the ATT&CK matrices for SparroWocky and FamousSparrow.
Listed in the 2024 FamousSparrow ATT&CK matrix; the content identifies a FamousSparrow C2 and download server. | Listed in the later FamousSparrow ATT&CK matrix.
Listed in the later FamousSparrow ATT&CK matrix.
Listed in the ATT&CK matrices for SparroWocky and FamousSparrow. | Listed in the SparroWocky and FamousSparrow ATT&CK tables.
Listed in all three ATT&CK matrices. | Listed in the SparroWocky and FamousSparrow ATT&CK tables.
18 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
26 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.