FHN 
FamousSparrow, a known cyber-espionage group, has been linked to a new backdoor called SparroWocky after attacks targeting internet-facing Microsoft Exchange servers.
The campaign has mainly focused on organizations in Latin America since mid-2025, with government entities among the observed targets. Researchers say the group has increasingly concentrated its activity in the region while deploying its newer malware.
Because Exchange servers handle email and often connect to other trusted systems, compromising one can give attackers access to valuable information and a potential path deeper into an organization.
A New Backdoor Emerges
Researchers from ESET identified SparroWocky as a new primary implant used by FamousSparrow. The group has been active since at least 2019 and has previously been associated with attacks against Microsoft Exchange servers.
SparroWocky is written in C and uses a modular design, allowing attackers to remotely control compromised systems and add functionality when needed.
The malware can reportedly:
- Execute commands on an infected computer
- Upload, download, and delete files
- Capture screenshots
- Collect system and network information
- Transfer stolen data to attackers
- Operate as a TCP proxy to reach other systems
These capabilities allow the attackers to maintain access while collecting information from compromised environments.
How the Attack Works
According to researchers, the attacks begin by exploiting publicly accessible Exchange servers.
After gaining access, the attackers use a multi-stage loader consisting of a legitimate executable, a malicious DLL, and an encrypted payload.
The legitimate program loads the malicious DLL through DLL side-loading, helping the malware appear less suspicious. The loader then decrypts the backdoor and places it directly into memory instead of writing the final payload to disk.
SparroWocky can also establish persistence using a Windows service or a Registry Run key.
Once active, it collects information such as:
- Computer and username details
- Domain information
- Windows version
- Network interface information
The malware then connects to its command-and-control infrastructure and waits for instructions.
Built for Stealth
SparroWocky includes several features designed to make detection and analysis more difficult.
The malware uses TLS for command-and-control traffic and RC4 encryption for transmitted data. It can also load Beacon Object Files, allowing attackers to add smaller modules without installing another complete program.
Researchers also identified techniques that can interfere with security analysis, including manipulating call stacks and dynamically locating Windows functions.
For defenders, this means relying only on traditional file-based detection may not be enough. Monitoring system behavior, memory activity, network connections, and persistence mechanisms can provide additional visibility.
What Organizations Should Check
Organizations running internet-facing Exchange servers should prioritize reducing their exposure and looking for signs of compromise.
Security teams should:
- Keep Exchange servers fully patched and supported.
- Remove unnecessary public exposure where possible.
- Monitor for unusual DLL side-loading activity.
- Look for unexpected Windows services and Registry Run entries.
- Investigate suspicious payload files and outbound connections.
- Review Exchange and IIS logs for unusual activity.
- Isolate systems showing signs of compromise.
- Preserve memory and forensic evidence before remediation.
- Rotate credentials that may have been exposed.
- Hunt for signs of lateral movement across connected systems.
The FamousSparrow campaign demonstrates how an exposed email server can become more than a single compromised machine. Once attackers establish a foothold, they may use custom malware to maintain access, collect information, and potentially move toward other systems.
For organizations operating public-facing Exchange infrastructure, patching, exposure management, monitoring, and post-compromise threat hunting remain essential layers of defense.
Indicators of compromise
| Type | Indicator | Description |
|---|---|---|
| SHA-1 | 3209689E509205CCDB7E49062B7B407DDC23CAC1 | winfsp-x64.dll, detected as SparroWocky loader |
| SHA-1 | 52C6646759CF6037BB17466203631C4BD794532F | winfsp-x64.dll, detected as SparroWocky loader |
| SHA-1 | E7070B5AF24A0FE1E6FEBE5954B03CB385E91F | DukeQt.dll, detected as SparroWocky loader |
| SHA-1 | 44F0A22B143B79FA760BF31E14C8FFF714C8A2A1 | In-memory SparroWocky backdoor sample |
| SHA-1 | 9AA9FF61BC63CCAB9074FE837F39C980CA9DDC8C | In-memory SparroWocky backdoor sample |
| IP address | 38.54.57.17 | SparroWocky command-and-control infrastructure, first seen February 25, 2026 |
| IP address | 38.60.197.55 | SparroWocky command-and-control infrastructure, first seen March 16, 2026 |
| IP address | 38.60.209.106 | SparroWocky command-and-control infrastructure, first seen February 26, 2026 |
| IP address | 38.60.224.51 | SparroWocky command-and-control infrastructure, first seen February 25, 2026 |
| IP address | 38.60.224.235 | SparroWocky command-and-control infrastructure, first seen February 24, 2026 |
| IP address | 38.60.241.65 | SparroWocky command-and-control infrastructure, first seen March 10, 2026 |
| IP address | 38.60.241.127 | SparroWocky command-and-control infrastructure, first seen March 4, 2026 |
| IP address | 38.60.241.193 | SparroWocky command-and-control infrastructure, first seen January 22, 2026 |
| IP address | 77.111.101.40 | SparroWocky command-and-control infrastructure, first seen May 20, 2026 |
| IP address | 91.148.134.115 | SparroWocky command-and-control infrastructure, first seen June 17, 2026 |
| IP address | 130.94.101.82 | SparroWocky command-and-control infrastructure, first seen February 26, 2026 |
| IP address | 140.99.164.199 | SparroWocky command-and-control infrastructure, first seen February 26, 2026 |
| IP address | 149.104.87.228 | SparroWocky command-and-control infrastructure, first seen February 24, 2026 |
| IP address | 149.104.90.203 | SparroWocky command-and-control infrastructure, first seen January 22, 2026 |
| IP address | 216.238.92.2 | SparroWocky command-and-control infrastructure, first seen February 25, 2026 |
| IP address | 216.238.105.53 | SparroWocky command-and-control infrastructure, first seen January 22, 2026 |
| IP address | 216.238.110.120 | SparroWocky command-and-control infrastructure, first seen December 11, 2025 |
| IP address | 216.238.121.164 | SparroWocky command-and-control infrastructure, first seen March 16, 2026 |
About the Author
