FamousSparrow exploits the Microsoft Exchange ProxyLogon vulnerability set discovered in March 2021
Researchers of ESET, a global leader in the cybersecurity market, have discovered a new cyberespionage group that primarily attacks hotels around the world, but also government agencies, international organizations, engineering firms and law firms. ESET has named this group FamousSparrow and believes it has been active since at least 2019. FamousSparrow victims have been located in Europe (France, Lithuania, United Kingdom), the Middle East (Israel, Saudi Arabia), the Americas (Brazil, Canada, Guatemala), Asia (Taiwan) and Africa (Burkina Faso). The targeting suggests that FamousSparrow's intent is cyberespionage.
By examining telemetry data, ESET Research found that FamousSparrow exploited Microsoft Exchange vulnerabilities known as ProxyLogon, previously reported by ESET in March 2021. This remote code execution vulnerability was used by more than 10 APT groups to take control of Exchange email servers around the world.
According to ESET telemetry, FamousSparrow started exploiting the bug on March 3, 2021, the day after the patches were released, which means that this is another APT group that was able to exploit the ProxyLogon vulnerabilities in March 2021. “This is another wake-up call that reminds us that it is crucial to quickly apply patches to Internet-connected applications or, if this is not possible, to avoid putting them online,” comments Matthieu Faou, researcher at ESET who with colleague Tahseen Bin Taj discovered FamousSparrow.
"FamousSparrow is currently the only user of the custom backdoor that we discovered during the investigation and which we called SparrowDoor. The group also uses two customized versions of Mimikatz. The presence of any of these custom malicious tools could be used to link attacks to FamousSparrow," explains ESET researcher Tahseen Bin Taj.
Although ESET Research considers FamousSparrow to be its own entity, there are some connections with other known APT groups. In one case, attackers deployed a variant of Motnug, an uploader used by SparklingGoblin. In another case, a machine compromised by FamousSparrow was also running Metasploit with cdn.kkxx888666[.]com as the command and control server, a domain linked to a group known as DRDControl.
More technical details on FamousSparrow, at that link su WeLiveSecurity.
