Victim

government of Argentina

1 mentions in 7 days · 1 in 30 days · 1 total · first seen Sep 17, 2026 · last 4h ago

Timeline1 articles

FamousSparrow Deploys New SparroWocky Backdoor Against Latin American Governments

China-aligned APT FamousSparrow deployed a new modular backdoor, SparroWocky, against government entities across eight Latin American countries since August 2025, ESET reports.

ESET reports that China-aligned threat actor FamousSparrow replaced its SparrowDoor implant with SparroWocky, a distinct modular C++ backdoor active against governments in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela. Around 90% of the group's targets from mid-2025 into 2026 were in Latin America, which ESET links to regional competition over US influence. The backdoor arrives via a three-component DLL side-loading chain, persists through a Windows service (ProcAuditManager) or Run keys (SnapCart), captures screenshots, and exfiltrates RC4-encrypted data over TLS C2 on ports 443 and 8080. It supports in-memory Beacon Object File execution, API hashing, and SilentMoonwalk-style call-stack spoofing; IOCs for three C2 servers were released.

GBHackersupdated 15:00 UTC · 16m agofirst 11:04 UTC · 4h agoThreat actor in the wild 5 sources CVE-2021-26855

Related CVEsby mentions

CVE-2021-268559.1100%
Unauthenticated SSRF/RCE in Microsoft Exchange Server (ProxyLogon)
CVE-2021-26855 is a server-side request forgery flaw (CWE-918) in Microsoft Exchange Server that allows an unauthenticated remote attacker to send specially crafted HTTP requests and have the Exchange server process them as itself, disclosing sensitive session information. When chained with sibling Exchange flaws (the 'ProxyLogon' chain), it yields authentication bypass and arbitrary file write, escalating to full remote code execution with SYSTEM-level privileges on the on-premises Exchange server. Any organization running an affected on-premises Exchange server reachable over HTTP/HTTPS (typically outbound webmail) is exposed; Exchange Online was not affected. Exploitation is confirmed in the wild at large scale: the flaw was mass-exploited beginning in early 2021 (notably by the HAFNIUM group), is on the CISA KEV with documented ransomware use, and has a maximum EPSS score of 100% (100th percentile), despite no public PoC listing.
· Microsoft Exchange Server On-premises Exchange Server editions supported in the vendor's March 2021 guidance (Exchange Server 2013, 2016, and 2019), prior to the March 2021 security upda KEV ransomware PoC ×4mass

Appears with

threat actor FamousSparrow 1 malware SparrowDoor 1 malware SparroWocky 1 organization ESET 1 product Mbed TLS 1 vendor ESET 1 victim government of Ecuador 1 victim government of Guatemala 1 victim government of Honduras 1 victim government of Panama 1 victim government of Peru 1 victim government of Puerto Rico 1 victim government of Venezuela 1

Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.