You will always remember this as the day you finally caught FamousSparrow

In mid 2024, ESET Research discovered an ongoing compromise at an organization in the United States that operates in the financial sector. The threat actor behind this attack is FamousSparrow, a cyberespionage group active since at least 2019, known for targeting governments and hotels around the world, and that we believe is aligned with China’s interests. The group has flown under the radar since 2022, but is now back with an updated arsenal, including a, previously undocumented, modular version of SparrowDoor.
This presentation will show a more complete picture of the group’s TTPs through collaboration with the targeted organization and EDR data. We will document this, along with the most interesting tools that were used. We will also provide insight into how FamousSparrow operates inside the network after gaining initial access, and how defenders can use this knowledge to detect and prevent such malicious activity.

Robert Lipovsky Bio
Robert Lipovsky is a Principal Threat Intelligence Researcher for ESET, with over 15 years' experience in cybersecurity and a broad spectrum of expertise covering both targeted APTs and crimeware. He is responsible for threat intelligence and malware analysis and leads the Malware Research Team at ESET headquarters in Bratislava.
He is a regular speaker at security conferences, including Black Hat USA, RSA Conference, Virus Bulletin, BlueHat, MITRE ATT&CKcon, Gartner Security & Risk Management Summit, and various NATO-organized conferences. He also teaches reverse engineering at the Slovak University of Technology – his alma mater – and at Comenius University.
When not bound to a keyboard, he enjoys traveling, playing guitar and flying single-engine airplanes.

RESEARCH

More presentations from Robert Lipovsky: Breakout Session - Press Track , BS PT 1 / Exclusive Research Presentation I.