FamousSparrow deployed two enhanced SparrowDoor variants and ShadowPad in July 2024 attacks, signaling active tool development.