SparrowDoor Backdoor: NCSC Malware Analysis Report on a Persistent Loader with Clipboard Logging, AV Detection, API Hooking, and Token Impersonation
SparrowDoor Backdoor (TL-2026-2136) is a medium-severity malware campaign, first published 2026-08-24. It is attributed to Salt Typhoon - G1045 (China) with medium confidence, affects Microsoft Windows, maps to 16 MITRE ATT&CK techniques (T1003.001, T1027, T1036.005), and is covered by 9 detection rules and 18 indicators of compromise.
Key facts for TL-2026-2136
- Threat ID
- TL-2026-2136
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-08-24
- Last reviewed
- 2026-08-24
- Attribution
- Salt Typhoon - G1045
- Attribution confidence
- MEDIUM
- Nation-state nexus
- China
- Motivation
- ESPIONAGE
- Target sectors
- government administration, hospitality, engineering, legal services, international organizations
- Target regions
- united kingdom, Europe, North America, 005 - South America, Middle East, Asia-Pacific
- Detection rules
- 9
- Indicators of compromise
- 18
Malware and tooling in SparrowDoor Backdoor
Malware and tooling: MimiKatz, SparrowDoor, Mimikatz
NCSC UK published a Malware Analysis Report (dated 28 February 2022, published 25 April 2022) on SparrowDoor, a persistent loader-and-backdoor discovered on a UK network in 2021 that XOR-encodes its C2 channel underneath HTTPS. Compared to the SparrowDoor variant ESET first documented in September 2021, this UK sample adds clipboard logging ('Clipshot'), an antivirus-detection routine, inline hooking of Windows API functions, and token impersonation.
How SparrowDoor Backdoor works
SparrowDoor is a Windows backdoor deployed via DLL search-order hijacking: a legitimate SearchIndexer-family binary loads a malicious loader DLL, which decrypts and executes an XOR-obfuscated shellcode payload from disk. Persistence is dual-layered — primarily as a fake Windows service impersonating the legitimate 'Windows Search Index' component, with a backup HKCU Run-key entry if service installation fails. Post-execution, the malware enters a beacon-and-tasking loop with a variable 3-8 minute inter-beacon sleep (denying operators a fixed periodicity), re-resolves its C2 domain roughly hourly, and shortens its sleep window to 1.5-4 seconds if no tasking has been received for five hours. C2 traffic runs over HTTPS with an additional XOR encoding layer on top (distinct XOR keys for outbound and inbound traffic, and a separate key for on-disk configuration, per ESET's original analysis of the closely related variant).
The UK-network sample analyzed by NCSC extends the malware's capability set beyond what ESET originally documented: a clipboard-logging export ('Clipshot') that is invoked via rundll32.exe (spawned from svchost.exe, command line containing 'curl_easy_init') and writes captured clipboard contents to a log file stored alongside the loader DLL; a routine to detect installed antivirus/security software; inline hooking of Windows API functions (NCSC's report ties the installed hooks to socket-option control and user impersonation); and token impersonation that adjusts the SparrowDoor process's access token — enabling SeDebugPrivilege and using the token associated with explorer.exe — to impersonate the logged-on user before establishing a C2 connection, then spawns child processes under that token via CreateProcessAsUserA. The malware also carries an uninstall routine that removes its persistence mechanisms, terminates spawned child processes, and deletes its own loader/payload files from disk.
Attribution: the NCSC report itself makes no actor attribution. SparrowDoor as a malware family is documented by ESET as used exclusively by FamousSparrow, a China-aligned cyberespionage group active since at least August 2019 that has targeted hotels, government bodies, international organizations, engineering firms, and law firms across at least 12 countries, and which began exploiting the Microsoft Exchange ProxyLogon vulnerability (CVE-2021-26855) on 3 March 2021, one day after the patch was released. Because NCSC characterizes its UK-network sample as structurally and functionally 'very similar' to the ESET-documented variant, the FamousSparrow association is recorded here as an inference from the malware family, not a claim the source document itself makes.
MITRE ATT&CK techniques used in TL-2026-2136
Credential Access
Defense Evasion
T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1070.004 File Deletion; T1070.009 Clear Persistence; T1140 Deobfuscate/Decode Files or Information; T1574.001 DLL
Execution
T1059.003 Windows Command Shell
Command and Control
T1071.001 Web Protocols; T1132.001 Standard Encoding
Discovery
T1082 System Information Discovery; T1518.001 Security Software Discovery
Privilege Escalation
T1134.001 Token Impersonation/Theft
Initial Access
T1190 Exploit Public-Facing Application
Persistence
T1543.003 Windows Service; T1547.001 Registry Run Keys / Startup Folder
Affected products and versions in SparrowDoor Backdoor
- Microsoft — Windows
Vulnerable versions: Windows Server and desktop editions with the Windows Search Indexer service present
Remediation for SparrowDoor Backdoor
Immediate actions
- Deploy the NCSC-published Sigma rules: alert on SearchIndexer.exe spawning svchost.exe, and on svchost.exe spawning rundll32.exe with 'curl_easy_init' in the command line
- Hunt across endpoints for the published SparrowDoor file hashes, the C2 domain cdn181.awsdns-531.com, the mutex Global\gup0, and the libcurl.dll.log clipboard-log artifact
- Isolate and rebuild any host where the fake SearchIndexer service (HKLM\SYSTEM\CurrentControlSet\services\SearchIndexer) or the HKCU Run\SearchIndexer backup key is found
Workarounds
- Block the known C2 domain and file hashes at proxy/EDR/DNS layers
- Restrict Windows service creation to an admin-approved allow-list to prevent masquerading as 'Windows Search Index'
Longer-term hardening
- Monitor for token-impersonation abuse: unexpected SeDebugPrivilege enablement and CreateProcessAsUserA calls using tokens duplicated from explorer.exe
- Enforce code-signing/application allow-listing on service binaries to block DLL search-order hijacking of legitimate indexer/search components
- Baseline and alert on outbound HTTPS traffic with irregular, jittered beacon intervals (3-8 minute sleep, hourly DNS re-resolution) consistent with SparrowDoor's C2 loop
Timeline of SparrowDoor Backdoor
- FamousSparrow, the group ESET documents as SparrowDoor's exclusive user, has been active since at least August 2019 (per ESET reporting; not stated in the NCSC report itself).
- The SparrowDoor variant that NCSC would later analyze was discovered on a UK network in 2021 (exact date not disclosed in the source).
- FamousSparrow began exploiting the Microsoft Exchange ProxyLogon vulnerability (CVE-2021-26855) one day after the patch was released, per ESET's original SparrowDoor reporting.
- ESET publishes 'FamousSparrow: A suspicious hotel guest,' the first public technical analysis of the SparrowDoor backdoor.
- NCSC's Malware Analysis Report on the UK-network SparrowDoor variant is dated/finalized (matches the Sigma rule metadata date).
- NCSC publishes the SparrowDoor Malware Analysis Report, indicator CSV, and Sigma rules on ncsc.gov.uk.
Sources cited for SparrowDoor Backdoor
- Malware analysis report on SparrowDoor malware
- NCSC Malware Analysis Report: SparrowDoor (PDF)
- NCSC MAR SparrowDoor indicators (CSV)
- NCSC MAR SparrowDoor Sigma detection rules
- FamousSparrow: A suspicious hotel guest
- You will always remember this as the day you finally caught FamousSparrow
- FamousSparrow APT: SparrowDoor Backdoor
- Detecting Token Impersonation - Security Spotlight
More in malware
- Macfinger ClickFix Campaign Delivers Atomic macOS Stealer (AMOS) via Fake Verification Prompts
- eBPF Rootkit Detection: VoidLink, LinkPro, and Atomic Arch Evade Kernel-Level Monitoring
- ClosedQuorum: Go-Based Windows Implant Delegates Post-Compromise Decisions to a Four-Model LLM Voting Panel
- Cisco Talos Open-Sources CAIRN to Hunt AI-Integrated Malware; Discloses CLOSEDQUORUM, First Documented AI-Orchestrated C2 Implant
- Larva-25012 Resumes Proxyware Distribution Campaign via DPLoader-Infected Systems
Detection coverage for TL-2026-2136
As of 2026-08-24, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2136 across Splunk SPL, Microsoft KQL and Sigma, covering 18 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.