Published · 23h agoSecurity5 min read
FamousSparrow shipped a new backdoor and reworked its old one, so indicators from prior reporting resolve to tooling it has already set down. The control that still works is knowing what you own.
Not a builder's beat, but builders have a standing stake in it.
Compiled by The WatchSomething wrong?How this is made
Positive Technologies puts the change plainly. In the first half of 2026 it found the group it tracks as FamousSparrow running a campaign on a heavily reworked SparrowDoor backdoor and a new one the researchers named SquawkDoor [1]. The group, also called Salt Typhoon and Earth Estries, has been active since 2019 and built its name on that proprietary SparrowDoor code [2]. The version defenders catalogued in earlier reporting is not the version doing the work now.
That is the quiet part of most espionage write-ups. The hashes, file names, and signatures shared after an intrusion describe the sample that was caught. When a group with its own toolshop reworks the backdoor and ships a second one beside it, the indicator you are matching against resolves to tooling the operator has already put down. A group that once chased hotels and government targets, and later telecommunications firms and ISPs for long-term access to lawful intercept systems, does not keep the same binaries around to be signatured [4].
The delivery is built to slip past rules keyed to old artifacts. FamousSparrow compromised websites and injected JavaScript that showed a fake error message and prompted the visitor to download a certificate, which was actually a malicious MSI that installed the backdoors [5]. In the shortcut branch, an archive named Strategi_AS_Referensi_April2026.rar carried an LNK that runs ftp.exe with the argument written as -""s:, where the Windows parser eats the quotation marks and defeats simple rules written for the -s option [6]. The injected JavaScript carried text tailored per country and endpoints named /report-url and /track-download for infection statistics, so the campaign could be scaled to each target even though mass infection was not observed [7]. The observed campaign reached Nepal, the Philippines, Indonesia, Taiwan, Egypt, Germany, and the Czech Republic, and one confirmed victim was an international research organization focused on food security whose platform served the fake certificates to its own researchers [23][9]. Every one of those choices moves the detectable behaviour away from the file you already hold a signature for.
Allure Security's fraud investigation reaches the same wall from the other side. Starting from one awkward phrase, "one of the largest digital banking providers," its team found roughly 2,200 domains, and 97 percent of the live ones carried artifacts from Cuex, a commercial template that cost 25 dollars [10]. That lineage is vivid, and Allure is direct that it has limited attribution value: shared code can come from a common developer or operator, a kit seller or reseller, or a shared deployment [11]. In FamousSparrow's case the group changed the code, so the old match no longer fires. In the fraud case the code matches everywhere, so the match names no one. Both leave the same conclusion. An indicator is a description of an artifact, not proof of who is behind it, and the artifact is the part most easily swapped. Where Positive Technologies did name a person, it was through operator error rather than tooling: the group made OPSEC mistakes that exposed one member preparing the attack, and the researchers separately noted overlaps with other East Asian groups [8].
A second failure runs through this week's material: the control a team believes is running and is not. Youssef Charfeddine's kernel research found that on a current Windows 11 build, SMAP was neutered before his exploit ever touched a user-mode pointer. The kernel entry path actively sets the RFLAGS AC bit between the SYSCALL instruction and the driver dispatch, and with AC set the CPU suppresses SMAP even though the CR4 enable bit is on [12]. The protection was present on paper and off in practice.
Payments show the same shape. Researchers at the University of Massachusetts Amherst revived expired contactless cards for new transactions because banks leave the expiration check to the point-of-sale terminal and trust its answer. On Visa terminals the modified card went through and five banks' backends did not catch it, while Mastercard, American Express, and Discover terminals rejected the change [13]. In a sponsored Risky Business interview, Push Security's Luke Jennings described device-code phishing that survives passkeys and phishing-resistant MFA by moving to the authorization layer [14]. Another indicator feed would not have told any of these teams that the control they were counting on was disarmed.
This is where the replacement control gets cheap, because it is a question about you rather than about a moving external target. Truffle Security re-verified 10,616 leaked AWS keys on August 10, 2026, credentials that had surfaced publicly between August 2022 and August 2026, and 88 percent still authenticate [15]. Of the 817 keys Truffle could tie to a real business, 768 give full control of the company's AWS account, 526 of them root keys and 242 IAM users holding AdministratorAccess [16][19]. That is 94 percent of the business-linked set handing over the whole account [20]. The median live key is five years old and was never rotated [17]. None of that is a detection gap. AWS had already flagged 929 of the active IAM users with its compromised-key quarantine policy, 112 of them under a version it stopped applying in 2023, which means those owners were told at least three years ago and the keys still work [18]. The exposure was seen. What went unanswered was the inventory question: which of our credentials are live, how old are they, and who owns the account they open.
The breach notices point the same way. SickKids traced its incident to a vulnerability in a third-party software application used by the hospital and other organizations, on its external careers site, with no patient data touched [21]. SFR detected an intrusion on July 2, 2026 into a tool used to manage and analyze its fibre connections, with the attackers naming an internal tool, and its response was to disable the account and block the source addresses [22]. Both are inventory in another form: which third-party component sits in the stack, which internal tool reaches the network, which account can still be used. That is a question an organization can answer about itself for the cost of looking, and it does not go stale the moment an operator recompiles, which is more than can be said for a description of someone else's backdoor.
Ranked by verification strength, evidence, and original report placement.
Positive Technologies discovered activity by the East Asian threat group FamousSparrow in the first half of 2026, running a campaign that used a heavily reworked variant of the modular SparrowDoor backdoor and a new backdoor the researchers named SquawkDoor.
FamousSparrow, also known as Salt Typhoon and Earth Estries, is an East Asian threat group active since 2019 and known for using its proprietary SparrowDoor backdoor.
FamousSparrow initially focused on attacks against hotels worldwide as well as government and international organizations, and later actively targeted telecommunications companies and internet service providers, apparently seeking long-term access to lawful communications intercept systems.
FamousSparrow compromised websites and injected malicious JavaScript that displayed a fake error message and prompted users to download a certificate, which was in reality a malicious MSI file that infected systems with the SquawkDoor and SparrowDoor backdoors.
One LNK attack used an archive named Strategi_AS_Referensi_April2026.rar whose shortcut executes ftp.exe with the argument -""s:, where the Windows parser consumes the quotation marks and bypasses simple detections written for the -s option.
The injected JavaScript contained text customized per target country and included functions for collecting infection statistics at endpoints /report-url and /track-download; no mass infection was observed, though the functionality supports scaling the campaign.
The reporting this story was synthesized from, earliest first. Every link goes to the original.
