FamousSparrow Swaps SparrowDoor For New SparroWocky Backdoor
China-aligned FamousSparrow deployed its new SparroWocky backdoor against Latin American governments since August 2025, initially accessing networks via exploited Exchange servers.
78
Malware
SparrowDoor
- Mentions · 7d0
- Mentions · 30d0
- All mentions5
- First seenSep 17, 2026
- Last mentionedSep 17, 2026
Timeline
5 articles · newest firstFamousSparrow Exploits Public-Facing Exchange Servers to Deploy SparroWocky Backdoor
ESET attributes a new SparroWocky backdoor to espionage group FamousSparrow, deployed via exploited internet-facing Exchange servers across Latin American governments.
78
FamousSparrow Deploys New SparroWocky Backdoor Against Latin American Governments
China-aligned APT FamousSparrow deployed a new modular backdoor, SparroWocky, against government entities across eight Latin American countries since August 2025, ESET reports.
78
China-Aligned FamousSparrow Deploys SparroWocky Backdoor Across Latin America
China-aligned espionage group FamousSparrow replaced SparrowDoor with a new modular backdoor, SparroWocky, targeting government entities across eight Latin American countries since August 2025.
74
Beware the SparroWock: The backdoor that bites, the commands that catch
ESET attributes a new modular C++ backdoor, SparroWocky, to China-aligned group FamousSparrow, deployed against government entities across Latin America since August 2025.
75
Related CVEs
by mentions- CVE-2021-26855100%9.1Unauthenticated SSRF/RCE in Microsoft Exchange Server (ProxyLogon)
Appears with
- SparroWockymalware · 5
- FamousSparrowthreat actor · 5
- ESETvendor · 5
- Earth Estriesthreat actor · 3
- ESETorganization · 3
- Salt Typhoonthreat actor · 2
- Trend Microvendor · 2
- government of Argentinavictim · 1
- Exchangeproduct · 1
- Microsoftvendor · 1
- Mbed TLSproduct · 1
- SparrowDoorproduct · 1
- SparroWockyproduct · 1
- government of Peruvictim · 1
- Cobalt Strikeproduct · 1
- government of Panamavictim · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.