Beware the SparroWock: The backdoor that bites, the commands that catch
ESET attributes a new modular C++ backdoor, SparroWocky, to China-aligned group FamousSparrow, deployed against government entities across Latin America since August 2025.
ESET Research reports that the China-aligned espionage group FamousSparrow, active since at least 2019, has replaced its SparrowDoor implant with a new custom backdoor dubbed SparroWocky since August 2025. The modular C++ backdoor manipulates low-level memory structures, patches code at runtime to evade detection, and can load and execute Beacon Object Files. Since mid-2025, roughly 90% of the group's targets have been in Latin America, including governmental organizations in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela. ESET links the regional pivot to China's response to renewed US interest in the region, citing Panama's dispute over canal-area ports as a likely intelligence objective.
- FamousSparrow abandoned SparrowDoor in favor of the distinct SparroWocky backdoor starting August 2025
- SparroWocky loads Beacon Object Files, patches code at runtime, and uses anti-analysis tricks
- 90% of targets since mid-2025 are in Latin America, mostly government organizations
- Campaign likely responds to renewed US engagement in Latin America, per ESET assessment
- Group previously exploited ProxyLogon; linked to Earth Estries, tracked separately from Salt Typhoon
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1059 Command and Scripting InterpreterT1106 Native APIT1027 Obfuscated Files or Information
- Vendors
- ESETTrend Micro
- Threat actors
- FamousSparrowEarth EstriesSalt Typhoon
- Malware
- SparroWockySparrowDoor
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 216.238.110.120 | configuration Field Value Additional details C&C IP address 216.238.110[.]120 C&C port number 443 Connection retry delay (in seconds) 1 |
| sha1 | 44f0a22b143b79fa760bf31e14c8fff714c8a2a1 | November 17 th , 2025 according to its PE timestamp (SHA-1: 44F0A22B143B79FA760BF31E14C8FFF714C8A2A1 ). The version of this backdoor appears to be 1.8 , based o |
From the original article
14 min read at welivesecurity.com
ESET researchers document SparroWocky, the new flagship backdoor of the FamousSparrow APT group
welivesecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.