China-Aligned FamousSparrow Deploys SparroWocky Backdoor Across Latin America
China-aligned espionage group FamousSparrow replaced SparrowDoor with a new modular backdoor, SparroWocky, targeting government entities across eight Latin American countries since August 2025.
ESET researchers report that China-aligned state-sponsored group FamousSparrow, active since at least 2019 and overlapping with Earth Estries and Salt Typhoon, has deployed a previously unreported modular C++ backdoor named SparroWocky in attacks on Latin America since at least August 2025. The implant replaces SparrowDoor as the group's primary tool and supports file execution, TCP proxying, command execution, screenshots, exfiltration, and self-deletion, using Mbed TLS, MinHook, COFF Loader, and SilentMoonwalk-style call-stack spoofing. Delivery occurs via a DLL sideloading chain; the initial access vector is unknown. About 90% of observed targets are in the region, including government entities in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela.
- SparroWocky is a modular C++ backdoor supporting command execution, TCP proxying, screenshots, in-memory plugin loading, and file exfiltration.
- Delivered via DLL sideloading; integrates open-source tools Mbed TLS, MinHook, COFF Loader, and SilentMoonwalk call-stack spoofing.
- Targets government entities in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela since July 2025.
- Group overlaps with Earth Estries and Salt Typhoon; active since 2019; 90% of tracked targets are in Latin America.
- ATT&CK
- T1574.002 Hijack Execution Flow: DLL Side-LoadingT1059 Command and Scripting InterpreterT1090 ProxyT1113 Screen CaptureT1041 Exfiltration Over C2 Channel
- Vendors
- ESET
- Products
- SparroWockySparrowDoor
- Threat actors
- FamousSparrowEarth EstriesSalt Typhoon
- Malware
- SparroWockySparrowDoor
From the original article
2 min read at thehackernews.com
The China-aligned state-sponsored threat actor known as FamousSparrow has been observed deploying a previously unreported backdoor called SparroWocky in attacks targeting multiple countries in Latin America since at least August 2025. "SparroWocky is a modular, C++ backdoor," ESET security researchers Alexandre Côté Cyr and Romain Dumont said in a technical report shared with The Hacker News
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.