{"id":42996,"date":"2021-09-23T10:00:35","date_gmt":"2021-09-23T10:00:35","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/researchers-finger-new-apt-group-famoussparrow-for-hotel-attacks\/"},"modified":"2021-09-23T10:00:35","modified_gmt":"2021-09-23T10:00:35","slug":"researchers-finger-new-apt-group-famoussparrow-for-hotel-attacks","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/researchers-finger-new-apt-group-famoussparrow-for-hotel-attacks\/","title":{"rendered":"Researchers finger new APT group, FamousSparrow, for hotel attacks"},"content":{"rendered":"

Researchers at security specialist ESET claim to have found a shiny new advanced persistent threat (APT) group dubbed FamousSparrow – after discovering its custom backdoor, SparrowDoor, on hotels and government systems around the world.<\/p>\n

“FamousSparrow is currently the only user of a custom backdoor that we discovered in the investigation and called SparrowDoor,” ESET researcher and co-author of the report Tahseen Bin Taj explained in a prepared statement. “The group also uses two custom versions of Mimikatz. The presence of any of these custom malicious tools could be used to connect incidents to FamousSparrow.”<\/p>\n

The group can be traced back to 2019, the researchers claimed, though the attacks tracked in the report made use of the ProxyLogon vulnerability<\/a> in Microsoft Exchange starting in March this year. Victims were spread around Europe, the Middle East, the Americas, Asia, and Africa – without a single one being discovered in the US, oddly.<\/p>\n