🚨 New #FamousSparrow campaign: meet SquawkDoor Our Threat Intelligence team at PT ESC has uncovered a new campaign by the East Asian APT group FamousSparrow. The group used a new backdoor we named SquawkDoor, along with an updated version of their known #SparrowDoor backdoor. 🎣 The group injected malicious JS into websites across multiple countries. Visitors saw a fake "certificate error" in their own language, urging them to download a "new certificate." In reality, the file was an MSI installer — and running it infected victims with the backdoors. 🔍 We took a close look at both tools: how SquawkDoor works, what's changed in SparrowDoor, and how they relate to #HemiGate, #TernDoor, and #CrowDoor. We also found several overlaps with other threat actors from East Asia. 🕵️ Separately, we identified a pentester linked to the group who was preparing attacks. Our Medium article reveals what kinds of applications this hacker had targeted before. Read: medium.com/@dzaripova1177/th… #Malware #Backdoor #APT #ThreatActor #EarthEstries #SaltTyphoon #GhostEmperor