Famoussparrow

FamousSparrow, also known as Salt Typhoon and GhostEmperor, is a threat actor attributed to a China-linked Advanced Persistent Threat (APT) group. The cybersecurity industry has been tracking the activities of this malicious entity since 2019. FamousSparrow has been associated with China's Ministry of State Security, playing a significant role in Beijing's foreign intelligence efforts. The group has targeted various sectors, including hotels and technology organizations, using sophisticated tactics, techniques, and procedures (TTPs). Their actions have caused significant concern within the global cybersecurity community. In recent campaigns, FamousSparrow has breached major U.S. broadband providers, such as Verizon, AT&T, and Lumen Technologies. This breach potentially allowed the group access to systems for lawful wiretapping and other data, raising serious security and privacy concerns. The group's activities have not only demonstrated their advanced capabilities but also their willingness to target critical infrastructure, further underlining the severity of the threat they pose. Recent analysis has led to a reassessment of the relationship between FamousSparrow and another threat group, Tropic Trooper. Industry reports from ESET in 2021 and others have suggested a link between these two groups based on observed implants and campaign attributes. This connection, if confirmed, could indicate a broader network of threat actors working in concert, thereby amplifying the potential risks and challenges for cybersecurity defense efforts.