GINC-APT-0924 · Tracked, unattributed

Scripted Sparrow

Category
Tracked, unattributed · A vendor’s working cluster, not yet attributed.
Origin
Unknown
Sources
3 sources carry it
Identifier
GINC-APT-0924 · scripted-sparrow

What it is

Scripted Sparrow is a prolific Business Email Compromise (BEC) collective that conducts highly targeted phishing campaigns, impersonating professional services firms to deceive finance teams into transferring funds. The group employs a disciplined approach, utilizing consistent language and familiar tones in their communications, while sending between 10,000 and 50,000 emails daily in small batches. They have developed a sophisticated understanding of corporate communication, crafting messages that mimic internal formats and urgency without raising suspicion. Scripted Sparrow relies on a network of US-based mule accounts, with 249 unique bank accounts identified across 42 financial institutions for cash-out operations.

Tools

The tools and malware families the sources tie to it.

  • Batch NET
  • CrossRat
  • Small-Net

Sources

  • Malpedia malpedia.caad.fkie.fraunhofer.de