One less feathered thief — plus one hundred rating points!

One less feathered thief — plus one hundred rating points! 😵

The Threat Intelligence team at Positive Technologies’ Expert Security Center has discovered a campaign by the East Asian group FamousSparrow. The group used a new backdoor that we named SquawkDoor, as well as a new version of the known SparrowDoor backdoor 🏴‍☠️

The group embedded malicious JS scripts on websites from various countries. They showed the user what appeared to be a certificate error in a specific language and offered to download a new certificate, which was an MSI file and led to infection with a malicious backdoor.

😳 We analyzed the backdoors: we showed the new SquawkDoor in detail and conducted a thorough analysis of the differences between the new SparrowDoor and the old version, as well as the related HemiGate, TernDoor, and CrowDoor.

In addition, we found various intersections with other East Asian threat actors. Also, during the analysis, we discovered a pentester associated with the group who was preparing attacks.

For information on which applications the attacker previously hacked and what his fetishes are — read in our blog 😏

#TI #APT #Malware
@ptescalator