FamousSparrow Exploits Public-Facing Exchange Servers to Deploy SparroWocky Backdoor
ESET attributes a new SparroWocky backdoor to espionage group FamousSparrow, deployed via exploited internet-facing Exchange servers across Latin American governments.
ESET's Welivesecurity team reports FamousSparrow gained initial access by exploiting publicly reachable Microsoft Exchange servers, with roughly 90 percent of targets since mid-2025 in Latin America, including governments in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela. The group's new modular C-language backdoor SparroWocky replaces SparrowDoor and uses a three-part loader: a legitimate executable, a malicious DLL side-loaded in memory, and an encrypted payload. It persists via Windows services or Registry Run keys, supports screenshots, file operations, TCP proxying, Beacon Object Files, TLS/RC4-encrypted C2, and anti-forensics such as call-stack spoofing. IOCs including loader SHA-1 hashes and C2 IP addresses were published.
- FamousSparrow active since at least 2019, previously tied to ProxyLogon exploitation
- SparroWocky replaces SparrowDoor as the group's main implant since August 2025
- Three-part loader uses DLL side-loading and maps the backdoor directly into memory
- Backdoor spoofes call stacks and hides thread starts to evade detection
- ESET published SHA-1 hashes and C2 infrastructure indicators
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1574.002 DLL Side-LoadingT1543.003 Windows ServiceT1547.001 Registry Run Keys / Startup FolderT1113 Screen Capture
- Products
- Microsoft Exchange
- Threat actors
- FamousSparrow
- Malware
- SparroWockySparrowDoor
- Organizations
- ESET
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 130.94.101.82 | control infrastructure, first seen June 17, 2026 IP address 130.94.101.82 SparroWocky command-and-control infrastructure, first seen |
| ipv4 | 140.99.164.199 | rol infrastructure, first seen February 26, 2026 IP address 140.99.164.199 SparroWocky command-and-control infrastructure, first seen |
| ipv4 | 149.104.87.228 | rol infrastructure, first seen February 26, 2026 IP address 149.104.87.228 SparroWocky command-and-control infrastructure, first seen |
| ipv4 | 149.104.90.203 | rol infrastructure, first seen February 24, 2026 IP address 149.104.90.203 SparroWocky command-and-control infrastructure, first seen |
| ipv4 | 216.238.105.53 | rol infrastructure, first seen February 25, 2026 IP address 216.238.105.53 SparroWocky command-and-control infrastructure, first seen |
| ipv4 | 216.238.110.120 | trol infrastructure, first seen January 22, 2026 IP address 216.238.110.120 SparroWocky command-and-control infrastructure, first seen |
| ipv4 | 216.238.121.164 | rol infrastructure, first seen December 11, 2025 IP address 216.238.121.164 SparroWocky command-and-control infrastructure, first seen |
| ipv4 | 216.238.92.2 | trol infrastructure, first seen January 22, 2026 IP address 216.238.92.2 SparroWocky command-and-control infrastructure, first seen |
| ipv4 | 38.54.57.17 | 80CA9DDC8C In-memory SparroWocky backdoor sample IP address 38.54.57.17 SparroWocky command-and-control infrastructure, first seen |
| ipv4 | 38.60.197.55 | rol infrastructure, first seen February 25, 2026 IP address 38.60.197.55 SparroWocky command-and-control infrastructure, first seen |
| ipv4 | 38.60.209.106 | ontrol infrastructure, first seen March 16, 2026 IP address 38.60.209.106 SparroWocky command-and-control infrastructure, first seen |
| ipv4 | 38.60.224.235 | rol infrastructure, first seen February 25, 2026 IP address 38.60.224.235 SparroWocky command-and-control infrastructure, first seen |
| ipv4 | 38.60.224.51 | rol infrastructure, first seen February 26, 2026 IP address 38.60.224.51 SparroWocky command-and-control infrastructure, first seen |
| ipv4 | 38.60.241.127 | ontrol infrastructure, first seen March 10, 2026 IP address 38.60.241.127 SparroWocky command-and-control infrastructure, first seen |
| ipv4 | 38.60.241.193 | control infrastructure, first seen March 4, 2026 IP address 38.60.241.193 SparroWocky command-and-control infrastructure, first seen |
| ipv4 | 38.60.241.65 | rol infrastructure, first seen February 24, 2026 IP address 38.60.241.65 SparroWocky command-and-control infrastructure, first seen |
| ipv4 | 77.111.101.40 | trol infrastructure, first seen January 22, 2026 IP address 77.111.101.40 SparroWocky command-and-control infrastructure, first seen |
| ipv4 | 91.148.134.115 | -control infrastructure, first seen May 20, 2026 IP address 91.148.134.115 SparroWocky command-and-control infrastructure, first seen |
| sha1 | 3209689e509205ccdb7e49062b7b407ddc23cac1 | ors of compromise (IoCs):- Type Indicator Description SHA-1 3209689E509205CCDB7E49062B7B407DDC23CAC1 winfsp-x64.dll , detected as SparroWocky loader SHA-1 52C66 |
| sha1 | 44f0a22b143b79fa760bf31e14c8fff714c8a2a1 | CB385E91F DukeQt.dll , detected as SparroWocky loader SHA-1 44F0A22B143B79FA760BF31E14C8FFF714C8A2A1 In-memory SparroWocky backdoor sample SHA-1 9AA9FF61BC63CCA |
| sha1 | 52c6646759cf6037bb17466203631c4bd794532f | 3CAC1 winfsp-x64.dll , detected as SparroWocky loader SHA-1 52C6646759CF6037BB17466203631C4BD794532F winfsp-x64.dll , detected as SparroWocky loader SHA-1 E7070 |
| sha1 | 9aa9ff61bc63ccab9074fe837f39c980ca9ddc8c | 4C8FFF714C8A2A1 In-memory SparroWocky backdoor sample SHA-1 9AA9FF61BC63CCAB9074FE837F39C980CA9DDC8C In-memory SparroWocky backdoor sample IP address 38.54.57.1 |
From the original article
4 min read at cybersecuritynews.com
FamousSparrow has introduced a new backdoor called SparroWocky after breaking into public-facing Microsoft Exchange servers. The campaign shows how a known espionage group can turn an exposed email system into a quiet, long-term entry point inside a government network. The impact extends beyond the first host, because email servers commonly hold sensitive messages and trusted […]
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.