Scripted Sparrow

Executive Summary

Scripted Sparrow is a highly automated Business Email Compromise collective that now distributes the largest volume of BEC phishing emails in the world, with estimates of up to 6 million messages per month. The gang exploits free and custom domains, mimics professional services firms, and uses mule accounts—largely in the US—to move stolen funds through dozens of financial institutions. Its scale and precision make it a persistent threat across finance, government and critical infrastructure sectors worldwide.

Goals & Targeting

Scripted Sparrow’s strategic objective is straightforward: maximize illicit financial returns by exploiting trust in corporate email systems. The group deliberately targets high‑value industries—financial services, government, media, telecommunications, defense, manufacturing, transportation, non‑profits and critical infrastructure—in countries with large multinational footprints or weak BEC detection, such as the United States, Russia, China, Ukraine, Japan, Pakistan and North Korea. By impersonating professional service providers that are expected to engage across these sectors, they increase the probability of convincing finance teams to execute fraudulent wire transfers, thereby achieving rapid cash outflows through mule accounts.

Key Capabilities

• Massive automated BEC phishing campaigns (10k‑50k messages per day)
• Use of multiple free webmail and custom domain addresses
• Mimicry of executive coaching / professional services firm communications
• Establishment of a network of mule bank accounts for fund movements
• Employment of well-known malware such as Emotet, SUNBURST, Agent Tesla, Cobalt Strike, Poison Ivy, Sliver, and various RATs to maintain persistence and potentially deliver credential harvesters
• Knowledge of corporate communication patterns to craft convincing messages
• Ability to quickly register new domains and de‑register them to avoid attribution

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Since its first detection in June 2024, Scripted Sparrow has maintained a relentless operational tempo, releasing up to six million targeted BEC emails per month. The gang’s campaigns rely on bulk emailing infrastructure—often free webmail accounts and freshly registered domains—which are rotated to evade reputation blacklists. Victims regularly fall for urgency‑laden requests requesting wire transfers from finance teams that appear legitimate due to the authentic tone. A significant portion of money moved is channeled through mule accounts domiciled in the United States, where approximately 249 unique bank accounts have been tied to victims across roughly forty‑two major financial institutions. Their activity shows a preference for industries with high-value financial flows, yet they do not restrict themselves to any single geographic boundary.

IOC Patterns

• Massive BEC phishing email campaigns using custom or free webmail addresses
• Use of domain registration and quick de‑registration to host malicious content (e.g., demo-cloud.space)
• Email spoofing from legitimate service‐provider aliases
• Coaching/consultancy‑themed email subject lines with urgent transfer requests
• Bank account luring via link or attachment that redirects to phishing landing pages
• Staging infrastructure on bulletproof or disposable hosting in the U.S.
• C2 and exfiltration over standard web protocols (HTTP/HTTPS) using PowerShell scripts

Recommended Actions

• Deploy advanced BEC detection solutions that analyse email content, sender reputation and behavioural patterns
• Enforce strict outbound wire‑transfer verification procedures—require a second authenticated confirmation from the original account holder or independent phone call
• "Zero‑trust" MFA for all finance personnel and critical accounts; avoid using single‑factor authentication on any transfer portal
• Implement DMARC, SPF, DKIM record enforcement to mitigate spoofing
• Maintain up‑to‑date threat intelligence feeds that include known Scripted Sparrow domain and email indicators
• Segment network segments with financial systems and isolate them from the broader corporate LAN
• Educate employees on emerging phishing tactics—specifically coaching or consulting firm impersonations—and conduct regular simulated attacks
• Monitor for rapid bulk SMTP activity on outbound mail servers and flag anomalous email volumes

Suggested Tags