New SparrowDoor Variants: Targeted Attacks on Organisations in the US and Mexico

The Chinese cyber-espionage group known as FamousSparrow has recently been linked to a series of cyberattacks targeting a trade association in the United States and a research institute in Mexico. The attacks, observed in July 2024, involved two new variants of the SparrowDoor malware, including a modular version, and the group's first known use of ShadowPad, malware widely used by Chinese state-sponsored actors.

Evolution of SparrowDoor's Capabilities

The new SparrowDoor variants represent a significant advance over previous versions. One updated version supports parallel command execution, allowing operations such as file I/O and the launch of interactive shells to run simultaneously. This approach improves the malware's efficiency by enabling it to handle several instructions at once.

The second variant introduces a modular architecture, with nine separate plugins offering advanced capabilities, including:

• Executing individual commands
• File-system operations
• Recording keystrokes (keylogging)
• Launching TCP proxies
• Interactive shell sessions
• Transferring files between the compromised host and the command-and-control (C&C) server
• Capturing screenshots
• Managing running processes
• Monitoring changes to the file system

Attack Chain and Infection Vectors

The attacks exploited vulnerabilities in Internet Information Services (IIS) servers, where a web shell was installed. This served as a means of downloading a batch script from a remote server, which subsequently launched a Base64-encoded .NET web shell. The latter ultimately deployed the SparrowDoor variants and ShadowPad.

The affected organisations were using outdated versions of Windows Server and Microsoft Exchange Server, highlighting the importance of keeping systems up to date to prevent such intrusions.

Implications and Recommendations

FamousSparrow's adoption of ShadowPad suggests a possible evolution in the group's tactics, with greater sharing of tools among different Chinese state-sponsored actors. SparrowDoor's new capabilities, particularly its modular architecture, increase the malware's flexibility and potential danger.

Organisations should take proactive measures to protect their infrastructure:

• Regularly update operating systems and applications to address known vulnerabilities.
• Implement advanced security solutions to monitor for and detect suspicious activity.
• Conduct regular security audits to identify and mitigate potential risks

For further details, see the original article on The Hacker News