Loading malware…
CrowDoor is a Windows backdoor associated with China-aligned espionage activity and assessed as a variant of SparrowDoor. It has been observed in intrusions linked to clusters including Earth Estries, Tropic Trooper, FamousSparrow-associated activity, UAT-9244, and reporting that also ties its use to Salt Typhoon-related operations. The malware has been deployed in campaigns targeting government entities and telecommunications organizations, including operations in Southeast Asia, the Middle East, and South America.
CrowDoor is commonly delivered through DLL side-loading chains that abuse legitimate signed or trusted executables to load a malicious DLL, decrypt an embedded or companion payload, and execute the backdoor in memory. Related intrusion chains have also used generic shellcode loaders such as Draculoader to deliver CrowDoor, and some campaigns loaded it as a second-stage payload after earlier compromise through web applications or server exploitation. Observed tradecraft places CrowDoor primarily in post-compromise operations rather than as a standalone initial infection mechanism.
Functionally, CrowDoor provides remote shell access, system information collection, file-system manipulation, and command-and-control communications. Reported capabilities include enumerating host details, creating processes or running arbitrary commands, reading and writing files, searching directories, enumerating drives, creating or renaming directories and files, and deleting artifacts. Variants support multiple execution modes controlled by command-line arguments, including installation, persistence setup, restart logic, and invocation of the main backdoor routine.
Persistence is established through Windows Registry Run keys or Windows service creation. Multiple reports describe CrowDoor restarting itself by injecting into legitimate processes, with msiexec.exe specifically noted in newer variants. Process injection is used both for execution and stealth. Some variants also remove persistence and delete their own components when instructed. CrowDoor has been observed dropping or launching additional tooling, including Cobalt Strike, and in at least one collaborative intrusion it was used as a delivery path for ShadowPad.
CrowDoor’s code and behavior show substantial overlap with SparrowDoor, including loader shellcode similarities, structural resemblance, and related command logic. Newer derivatives such as TernDoor retain the same lineage while modifying command codes and adding process-control functionality through an embedded driver. Overall, CrowDoor is best characterized as a modular espionage backdoor used in long-dwell intrusions against high-value networks, especially telecommunications and government environments.
4 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
During the same period, we also observed other compromised hosts within the same organization communicating with the C&C infrastructure associated with the sub-domain of CrowDoor backdoor.
This attack chain was attempting to load the Crowdoor loader, which is half-named after the SparrowDoor backdoor... The malicious samples are called Crowdoor, which, when run, drop CobaltStrike and maintain persistence.
A variant of Crowdoor (itself a variant of SparrowDoor), the backdoor is said to have been put to use by UAT-9244 since at least November 2024.
TernDoor is a variant of CrowDoor, a backdoor deployed in recent intrusions linked to China-nexus APTs such as FamousSparrow and Earth Estries. CrowDoor is a variant of SparrowDoor...
17 distinct techniques documented for this family, organized by ATT&CK tactic.
On January 22, 2025, Earth Estries likely leveraged an unmanaged host to compromise a vulnerable internal web server (Vulnerable Web Server X).
"However, in some instances, WMIC may be used in its place to achieve similar results."
"A set of batch files will then be copied and executed to perform the extraction, installation, and execution of the malware."
Additionally, the same approach was used for both: leveraging a legitimate executable file vulnerable to DLL search-order hijacking, which would load a malicious DLL dropped into the same path as the legitimate executable.
The Crowdoor payload from this chain stays active by creating a Windows service named WinStore, which is used as the service name, display name and description.
If creation of the service fails, the payload uses the registry auto-start extensibility point (ASEP) at HKCU\Software\Microsoft\Windows\CurrentVersion\Run with the value WinStore to persist.
When executed, it injects itself into the colorcpl.exe process with the command-line argument “2”... The main loading functionality was designed to execute a legitimate msiexec.exe process, then inject the next stage by writing into its remote address space and creating a remote thread to execute it.
The Crowdoor payload from this chain stays active by creating a Windows service named WinStore, which is used as the service name, display name and description.
If creation of the service fails, the payload uses the registry auto-start extensibility point (ASEP) at HKCU\Software\Microsoft\Windows\CurrentVersion\Run with the value WinStore to persist.
When executed, it injects itself into the colorcpl.exe process with the command-line argument “2”... The main loading functionality was designed to execute a legitimate msiexec.exe process, then inject the next stage by writing into its remote address space and creating a remote thread to execute it.
This function implements the main functionality for this loader, decrypting the shellcode for the next stage from a memory buffer inside the datastate.dll file using a variant of the RC4 stream cipher.
In this incident, our telemetry points to the malware export being called using the rundll32 command from the a.bat file.
Additionally, the same approach was used for both: leveraging a legitimate executable file vulnerable to DLL search-order hijacking, which would load a malicious DLL dropped into the same path as the legitimate executable.
"In later stages of the attack, the backdoors may be used directly to perform lateral movement."
"Collect ComputerName,Username, OS version and hostnet or IP information"
2nd Stageでは 遠隔操作によってその端末の情報をより深く調査したり、その端末から横移動をして別の端末やサーバを攻撃したりします。
"Earth Estries uses PSExec to laterally install its backdoors and tools... by copying the CAB files... and a batch file to perform the installation"
"archived using the tar command"; "Earth Estries utilizes RAR for collecting information of interest"
When executed, it injects itself into the colorcpl.exe process with the command-line argument “2” and tries to contact a C2 server that is hardcoded in the payload using its configuration (blog.techmersion[.]com on port 443).
The attackers then started dropping various samples on this server, notably a dropper that was pushing more compiled variants carrying the same functionality... The attackers tried to drop additional post-exploitation tools to achieve their main objectives.
2nd Stageでは 遠隔操作によってその端末の情報をより深く調査したり、その端末から横移動をして別の端末やサーバを攻撃したりします。
27 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.