Threat Intelligence Tarot
Vol. II · 117
China
★★★★★
risk 4/5
✦ The Tower of Sparrows ✦
Earth Estries
FamousSparrow · GhostEmperor-adjacent · UNC2286
TelecommunicationsGovernmentTechnologyAsia-PacificSouth America
Active since ~2020 · Telecommunications espionage, Government intelligence
The Tower of Sparrows is built one breach at a time, each compromised carrier becoming a perch from which to watch the rest. By the time defenders see the silhouette, the tower is taller than the skyline.
Tactics & Techniques
RCN
RDV
INI
EXC
PRS
PRV
EVA
CRD
DSC
LAT
COL
C2
EXF
IMP
Notable Operations
- ◆Telecom backbone intrusions across 2023-2024 (Trend Micro disclosure)
- ◆Demodex kernel-mode rootkit deployments
- ◆Zingdoor and HemiGate backdoor families
- ◆Crowdoor implant against Asia-Pacific governments
Defenses
- ▸Telecom-sector ISAC participation and IOC sharingNIST CSF: RS.CO ↗
- ▸Kernel driver allowlisting and signed-driver scrutinyMITRE D3FEND
- ▸Network device firmware integrity monitoringNIST CSF: PR.DS ↗
- ▸Web shell scanning on all internet-facing serversNIST CSF: DE.CM ↗
Reversed: Their Weakness
Telecom-sector intelligence sharing through national CERTs is its primary counterweight. When carriers share IOCs before regulators do, the tower stops growing.
Share this adversary profile
Compare →swipe to browse
Related Adversaries
Data sourced from MITRE ATT&CK. For educational purposes.