SparrowDoor Backdoor: NCSC Malware Analysis Report on a Persistent Loader with Clipboard Logging, AV Detection, API Hooking, and Token Impersonation — Threadlinqs Intelligence
As of 2026-08-24, SparrowDoor Backdoor: NCSC Malware Analysis Report on a Persistent Loader with Clipboard Logging, AV Detection, API Hooking, and Token Impersonation is a medium-severity malware threat attributed to Salt Typhoon - G1045 (China), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 18 indicators of compromise.
Threat ID: TL-2026-2136 · Severity: MEDIUM · Status: ACTIVE · Category: MALWARE
Attribution: Salt Typhoon - G1045 · China · ESPIONAGE
NCSC UK published a Malware Analysis Report (dated 28 February 2022, published 25 April 2022) on SparrowDoor, a persistent loader-and-backdoor discovered on a UK network in 2021 that XOR-encodes its
SparrowDoor is a Windows backdoor deployed via DLL search-order hijacking: a legitimate SearchIndexer-family binary loads a malicious loader DLL, which decrypts and executes an XOR-obfuscated shellcode payload from disk. Persistence is dual-layered — primarily as a fake Windows service impersonating the legitimate 'Windows Search Index' component, with a backup HKCU Run-key entry if service installation fails. Post-execution, the malware enters a beacon-and-tasking loop with a variable 3-8 minute inter-beacon sleep (denying operators a fixed periodicity), re-resolves its C2 domain roughly hourly, and shortens its sleep window to 1.5-4 seconds if no tasking has been received for five hours. C2 traffic runs over HTTPS with an additional XOR encoding layer on top (distinct XOR keys for outbound and inbound traffic, and a separate key for on-disk configuration, per ESET's original analysis of the closely related variant).
The UK-network sample analyzed by NCSC extends the malware's capability set beyond what ESET originally documented: a clipboard-logging export ('Clipshot') that is invoked via rundll32.exe (spawned from svchost.exe, command line containing 'curl_easy_init') and writes captured clipboard contents to a log file stored alongside the loader DLL; a routine to detect installed antivirus/security software; inline hooking of Windows API functions (NCSC's report ties the installed hooks to socket-option control and user impersonation); and token impersonation that adjusts the SparrowDoor process's access token — enabling SeDebugPrivilege and using the token associated with explorer.exe — to impersonate the logged-on user before establishing a C2 connection, then spawns child processes under that token via CreateProcessAsUserA. The malware also carries an uninstall routine that removes its persistence mechanisms, terminates spawned child processes, and deletes its own loader/payload files from disk.
Attribution: the NCSC report itself makes no actor attribution. SparrowDoor as a malware family is documented by ESET as used exclusively by FamousSparrow, a China-aligned cyberespionage group active since at least August 2019 that has targeted hotels, government bodies, international organizations, engineering firms, and law firms across at least 12 countries, and which began exploiting the Microsoft Exchange ProxyLogon vulnerability (CVE-2021-26855) on 3 March 2021, one day after the patch was released. Because NCSC characterizes its UK-network sample as structurally and functionally 'very similar' to the ESET-documented variant, the FamousSparrow association is recorded here as an inference from the malware family, not a claim the source document itself makes.
Target sectors: government administration, hospitality, engineering, legal services, international organizations
Target regions: united kingdom, Europe, North America, 005 - South America, Middle East, Asia-Pacific
Timeline
- FamousSparrow, the group ESET documents as SparrowDoor's exclusive user, has been active since at least August 2019 (per ESET reporting; not stated in the NCSC report itself).
- The SparrowDoor variant that NCSC would later analyze was discovered on a UK network in 2021 (exact date not disclosed in the source).
- FamousSparrow began exploiting the Microsoft Exchange ProxyLogon vulnerability (CVE-2021-26855) one day after the patch was released, per ESET's original SparrowDoor reporting.
- ESET publishes 'FamousSparrow: A suspicious hotel guest,' the first public technical analysis of the SparrowDoor backdoor.
- NCSC's Malware Analysis Report on the UK-network SparrowDoor variant is dated/finalized (matches the Sigma rule metadata date).
- NCSC publishes the SparrowDoor Malware Analysis Report, indicator CSV, and Sigma rules on ncsc.gov.uk.
Detections & IOCs
As of 2026-09-06, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 18 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, MEDIUM, threat intelligence, cybersecurity, T1190, T1059.003, T1543.003, T1547.001, T1134.001, T1574.001, T1036.005, T1140, T1027, T1070.004
