China's Salt Typhoon backdoors Latin American orgs with new snooping malware
China-linked Salt Typhoon deployed new modular backdoor SparroWocky against Latin American government agencies since August 2025.
ESET (tracking the group as FamousSparrow) reports Salt Typhoon targeted governments in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela, with 90 percent of targets in Latin America from mid-2025 into 2026. SparroWocky is a C++ backdoor using Mbed TLS, MinHook, COFF Loader, and SilentMoonwalk call-stack spoofing, deployed via DLL side-loading in a trident loader scheme. Researchers link the regional pivot to monitoring government reactions to US pressure under the Trump administration.
- Backdoor offers nearly 30 commands including screenshots, file theft, and lateral spawning
- Uses TLS on port 443 and 8080 for C2 communications
- Employs API hooking, call-stack spoofing, and API hashing for evasion
- Targets rare for China-aligned APTs, tied to US-China competition in the region
- ATT&CK
- T1574.002 DLL Side-LoadingT1620 Reflective Code LoadingT1573 Encrypted ChannelT1113 Screen CaptureT1005 Data from Local System
- Vendors
- ESET
- Products
- Mbed TLSMinHookCOFF Loader
- Threat actors
- Salt TyphoonFamousSparrow
- Malware
- SparroWocky
From the original article
3 min read at theregister.comChina’s Salt Typhoon gang has developed a new backdoor and dropped it in networks belonging to high-profile organizations in several countries across Central and South America since at least August 2025, according to researchers.
By Jessica Lyons · theregister.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.