ESET maps APT activity from April through September 2026
China-, Iran-, North Korea- and Russia-aligned groups hit governments, semiconductors, drones, crypto firms and Ukraine.
72
Threat actor
FamousSparrow
- Mentions · 7d1
- Mentions · 30d1
- All mentions13
- First seenAug 20, 2026
- Last mentioned3d ago
Timeline
13 articles · newest firstChina's FamousSparrow APT Spies on US Politics in Latin America
China-linked APT FamousSparrow is running a stealthy backdoor espionage campaign targeting US political interests in Latin America.
58
China's Salt Typhoon backdoors Latin American orgs with new snooping malware
China-linked Salt Typhoon deployed new modular backdoor SparroWocky against Latin American government agencies since August 2025.
76
China’s FamousSparrow hackers target Latin America with new backdoor
ESET links a new SparroWocky backdoor campaign against Latin American government agencies to Chinese espionage group FamousSparrow.
78
FamousSparrow Swaps SparrowDoor For New SparroWocky Backdoor
China-aligned FamousSparrow deployed its new SparroWocky backdoor against Latin American governments since August 2025, initially accessing networks via exploited Exchange servers.
78
SilkParasite Infrastructure Links SpiceRAT to Central Asian Targets
Hunt.io linked SpiceRAT, NodeEdgeRAT, and NomadRAT C2 servers to the SilkParasite campaign targeting Central Asian governments since mid-2022.
72
SilkParasite-Linked Malware Infrastructure Traced Back Four Years Across Central Asia
Hunt.io links SpiceRAT C2 servers to China-nexus SilkParasite espionage targeting Central Asian governments, with related infrastructure active since 2022.
60
FamousSparrow Exploits Public-Facing Exchange Servers to Deploy SparroWocky Backdoor
ESET attributes a new SparroWocky backdoor to espionage group FamousSparrow, deployed via exploited internet-facing Exchange servers across Latin American governments.
78
FamousSparrow Deploys New SparroWocky Backdoor Against Latin American Governments
China-aligned APT FamousSparrow deployed a new modular backdoor, SparroWocky, against government entities across eight Latin American countries since August 2025, ESET reports.
78
China-Aligned FamousSparrow Deploys SparroWocky Backdoor Across Latin America
China-aligned espionage group FamousSparrow replaced SparrowDoor with a new modular backdoor, SparroWocky, targeting government entities across eight Latin American countries since August 2025.
74
Chinese hackers use SparroWocky malware in govt espionage attacks
ESET reports China-linked FamousSparrow deployed a new modular backdoor, SparroWocky, in year-long espionage attacks on Latin American government organizations.
70
Beware the SparroWock: The backdoor that bites, the commands that catch
ESET attributes a new modular C++ backdoor, SparroWocky, to China-aligned group FamousSparrow, deployed against government entities across Latin America since August 2025.
75
SilkParasite Espionage Campaign Targets Central Asian Governments with Five New RATs
Bitdefender reports SilkParasite, a China-nexus espionage cluster targeting Central Asian governments with seven RATs, five newly documented, delivered via spearphished RAR archives.
70
Related CVEs
by mentions- CVE-2021-26855100%9.1Unauthenticated SSRF/RCE in Microsoft Exchange Server (ProxyLogon)
Appears with
- ESETvendor · 9
- SparroWockymalware · 8
- SparrowDoormalware · 5
- Salt Typhoonthreat actor · 4
- ESETorganization · 4
- Earth Estriesthreat actor · 3
- SpiceRATproduct · 3
- NomadRATproduct · 2
- RTX Corporationorganization · 2
- NodeEdgeRATproduct · 2
- SilkParasitethreat actor · 2
- Trend Microvendor · 2
- Mbed TLSproduct · 2
- IndigoZebrathreat actor · 2
- NomadRATmalware · 2
- Hunt.iovendor · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.