FamousSparrow Exploits Public-Facing Exchange Servers to Deploy SparroWocky Backdoor

FamousSparrow has introduced a new backdoor called SparroWocky after breaking into public-facing Microsoft Exchange servers.

The campaign shows how a known espionage group can turn an exposed email system into a quiet, long-term entry point inside a government network.

The impact extends beyond the first host, because email servers commonly hold sensitive messages and trusted network connections.

The activity has concentrated on Latin America since mid-2025, with governments in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela among the observed targets.

Researchers recorded 90 percent of the group’s targets in the region from mid-2025 into 2026, marking a sharp change from its earlier worldwide focus. Analysts at Welivesecurity identified the malware as FamousSparrow’s new main implant, replacing SparrowDoor from August 2025.

The group, active since at least 2019, was previously associated with attacks exploiting ProxyLogon, while recent reporting also detailed FamousSparrow’s Exchange breach of an energy-sector network.

Welivesecurity said in a report shared with Cyber Security News (CSN) that SparroWocky is a modular C-language backdoor designed for stealth and flexible operator control.

Its arrival matters because it combines data theft and remote access with techniques intended to make investigation and detection harder.

FamousSparrow Exploits Public-Facing Exchange Servers

FamousSparrow gained initial access by exploiting publicly reachable Exchange servers, according to the researchers’ mapping of the intrusion.

This is a familiar danger for organizations operating on-premises mail infrastructure: a single internet-facing weakness can provide an attacker with a foothold before normal user protections come into play. The group uses a three-part loader made up of a legitimate executable, a malicious DLL, and an encrypted payload file.

The executable loads the counterfeit library through DLL side-loading, allowing the malicious code to blend in with a trusted program, a technique also seen in this silent Windows backdoor analysis.

The loader decrypts the payload and maps it directly into memory rather than saving the final backdoor to disk. It can establish persistence through a Windows service or a Registry Run key, then collect the computer name, user and domain details, Windows version, and network-interface addresses.

Once connected, SparroWocky can run commands, move or remove files, capture screenshots, and send stolen material over its command-and-control channel. It can also act as a TCP proxy, potentially giving operators a route to reach other systems from a compromised host.

Stealth Features Raise Defense Pressure

The backdoor uses TLS for command traffic and RC4 encryption for transmitted content. It can load Beacon Object Files, compact modules used by red-team tools, giving operators a way to extend the implant without deploying a separate full program to disk.

Its authors also built in measures to confuse security monitoring. SparroWocky can disguise call stacks, dynamically locate Windows functions, hide thread start addresses, and create a false record of a loaded module.

These features make routine alerts less reliable and increase the value of memory and behavior-based investigation. The immediate priority is to patch internet-facing Exchange servers, remove or restrict unnecessary public access, and verify that servers run supported, current builds.

Teams should treat public exploit code and reports of exposed Exchange server exploitation as a reminder to inventory external services rather than assume perimeter controls are sufficient.

Defenders should also hunt for unexpected DLL side-loading, new services or Registry Run entries, suspicious .dat payload files, and unusual outbound TLS sessions to the listed addresses.

Review Exchange and IIS logs for abnormal activity, isolate suspected hosts, preserve memory evidence, rotate potentially exposed credentials, and investigate nearby systems for follow-on access.

This campaign illustrates a broader shift in which a proven intrusion group is pairing targeted regional espionage with a more capable custom implant.

Organizations that rely on public-facing Exchange systems should make rapid patching, continuous exposure checks, and post-compromise hunting routine parts of their defense plan, especially given recent Exchange vulnerability patch guidance.

Indicators of compromise (IoCs):-

Type	Indicator	Description
SHA-1	3209689E509205CCDB7E49062B7B407DDC23CAC1	winfsp-x64.dll, detected as SparroWocky loader
SHA-1	52C6646759CF6037BB17466203631C4BD794532F	winfsp-x64.dll, detected as SparroWocky loader
SHA-1	E7070B5AF24A0FE1E6FEBE5954B03CB385E91F	DukeQt.dll, detected as SparroWocky loader
SHA-1	44F0A22B143B79FA760BF31E14C8FFF714C8A2A1	In-memory SparroWocky backdoor sample
SHA-1	9AA9FF61BC63CCAB9074FE837F39C980CA9DDC8C	In-memory SparroWocky backdoor sample
IP address	38.54.57.17	SparroWocky command-and-control infrastructure, first seen February 25, 2026
IP address	38.60.197.55	SparroWocky command-and-control infrastructure, first seen March 16, 2026
IP address	38.60.209.106	SparroWocky command-and-control infrastructure, first seen February 26, 2026
IP address	38.60.224.51	SparroWocky command-and-control infrastructure, first seen February 25, 2026
IP address	38.60.224.235	SparroWocky command-and-control infrastructure, first seen February 24, 2026
IP address	38.60.241.65	SparroWocky command-and-control infrastructure, first seen March 10, 2026
IP address	38.60.241.127	SparroWocky command-and-control infrastructure, first seen March 4, 2026
IP address	38.60.241.193	SparroWocky command-and-control infrastructure, first seen January 22, 2026
IP address	77.111.101.40	SparroWocky command-and-control infrastructure, first seen May 20, 2026
IP address	91.148.134.115	SparroWocky command-and-control infrastructure, first seen June 17, 2026
IP address	130.94.101.82	SparroWocky command-and-control infrastructure, first seen February 26, 2026
IP address	140.99.164.199	SparroWocky command-and-control infrastructure, first seen February 26, 2026
IP address	149.104.87.228	SparroWocky command-and-control infrastructure, first seen February 24, 2026
IP address	149.104.90.203	SparroWocky command-and-control infrastructure, first seen January 22, 2026
IP address	216.238.92.2	SparroWocky command-and-control infrastructure, first seen February 25, 2026
IP address	216.238.105.53	SparroWocky command-and-control infrastructure, first seen January 22, 2026
IP address	216.238.110.120	SparroWocky command-and-control infrastructure, first seen December 11, 2025
IP address	216.238.121.164	SparroWocky command-and-control infrastructure, first seen March 16, 2026

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC