GhostEmperor__2021__FamousSparrow_A_suspicious_hotel_guest_WeLiveSecurity.pdf

ESET researchers uncovered FamousSparrow, an espionage-focused APT active since at least 2019 that targets hotels and other organizations worldwide; the report details how the group exploited public-facing application vulnerabilities (including Microsoft Exchange ProxyLogon, SharePoint, and Oracle Opera) to deploy a custom backdoor called SparrowDoor via DLL search-order hijacking, explains its encrypted shellcode, C2 protocol and commands, lists IoCs and sample hashes, and maps observed behaviors to MITRE ATT&CK techniques.