FamousSparrow Swaps SparrowDoor For New SparroWocky Backdoor
China-aligned FamousSparrow deployed its new SparroWocky backdoor against Latin American governments since August 2025, initially accessing networks via exploited Exchange servers.
ESET attributes the SparroWocky campaign to FamousSparrow with high confidence, partly because early infections were delivered via the group's exclusive SparrowDoor implant. Since at least August 2025, the modular C++ backdoor was found at government entities in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela, with 90% of the group's mid-2025 telemetry targets in the region. SparroWocky supports command execution, file execution, TCP proxying, host reconnaissance, screenshot capture, RC4-encrypted TLS exfiltration, and Cobalt Strike BOF loading, using runtime patching and call-stack forging for evasion. ESET links the regional focus to China's response to renewed US interest in Latin America and notes a possible, unclear link to Trend Micro's Earth Estries.
- SparroWocky is a distinct family, not a SparrowDoor variant
- 90% of ESET telemetry targets from mid-2025 were in Latin America
- Initial access achieved via publicly reachable Exchange servers
- Evasion uses runtime code patching and forged Windows API call stacks
- Panamanian target involved in port concession dispute with China-based company
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1059 Command and Scripting InterpreterT1090 ProxyT1113 Screen CaptureT1041 Exfiltration Over C2 Channel
- Vendors
- ESETTrend Micro
- Products
- ExchangeCobalt Strike
- Threat actors
- FamousSparrowEarth Estries
- Malware
- SparroWockySparrowDoor
- Organizations
- ESET
From the original article
2 min read at infosecurity-magazine.com
ESET said FamousSparrow has replaced SparrowDoor with SparroWocky
By Alessandro Mascellino · infosecurity-magazine.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.