FamousSparrow Deploys New SparroWocky Backdoor Against Latin American Governments

China-aligned advanced persistent threat group FamousSparrow has replaced its long-running SparrowDoor implant with a new modular C++ backdoor, SparroWocky, in a sustained cyberespionage campaign against government entities across Latin America.

ESET says the malware has been active in the region since at least August 2025, following a sharp shift in the group’s victim targeting that began a month earlier.

The campaign represents a notable geographic concentration for a China-aligned threat actor.

From mid-2025 into 2026, approximately 90% of FamousSparrow targets recorded in ESET telemetry were located in Latin America.

Researchers observed SparroWocky deployed against government organizations in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela.

ESET assesses the activity may be connected to China’s interest in monitoring how regional governments respond to growing US political, economic, and strategic engagement in Latin America.

The affected region has become increasingly important in competition over infrastructure, energy, mining, telecommunications, trade routes, and investment influence.

While intent attribution remains analytical rather than confirmed, the victimology indicates an intelligence-collection operation focused on high-value governmental decision-making.

FamousSparrow has been active since at least 2019 and was initially associated with compromises of hotels worldwide.

The group later expanded to governments, international organizations, trade groups, engineering firms, law firms, and research entities.

ESET first publicly documented the cluster in 2021, when it exploited the Microsoft Exchange ProxyLogon vulnerability, tracked as CVE-2021-26855.

The shift to SparroWocky is significant because it is not a new SparrowDoor variant but a distinct malware family.

ESET attributes the new backdoor to FamousSparrow with high confidence: early incidents used the group-exclusive SparrowDoor malware to deploy SparroWocky, and several of the newly targeted organizations had previously faced SparrowDoor-related intrusion attempts.

The new implant’s name comes from the first stanza of Lewis Carroll’s Jabberwocky, found embedded in initial samples.

The strings likely originate from cryptographic test vectors included in older Mbed TLS code rather than reflecting the malware’s own encryption implementation.

It can execute arbitrary commands and files, enumerate drives and directories, upload and exfiltrate files, capture periodic screenshots, collect host and network details, and establish TCP proxying and port-forwarding capabilities.

Information stolen from compromised devices is encrypted with RC4 and transmitted through TLS-protected command-and-control communications.

ESET Researchers said that, SparrowWocky is a full-featured remote-access backdoor engineered for flexible post-compromise operations and defense evasion.

SparroWocky Backdoor

The implant can establish persistence through a Windows service, observed as ProcAuditManager, or through the SOFTWARE\Microsoft\Windows\CurrentVersion\Run registry key, using the value SnapCart.

Depending on privileges, the registry persistence can be created under either HKLM or HKCU.

SparroWocky reaches the endpoint through a three-component DLL side-loading chain: a legitimate executable, a patched malicious DLL, and an RC4-encrypted .dat payload.

The loader decrypts the payload and reflectively maps it into memory, avoiding the creation of a conventional malicious executable on disk.

The backdoor’s developers show a strong understanding of Windows internals.

SparroWocky dynamically resolves Windows APIs via hashing, patches code at runtime, manipulates process memory, and forges low-level structures used to track loaded modules.

These measures are designed to make malicious code appear more legitimate to endpoint monitoring products and automated analysis systems.

One notable feature is its use of MinHook to intercept CreateThread. The technique conceals the true malicious thread start address by making newly created threads appear to begin at the legitimate Windows AnimateWindow API.

The malware also applies a SilentMoonwalk-style call-stack spoofing method to obscure the real origin of monitored API calls.

SparroWocky can additionally load and execute Beacon Object Files directly in memory. BOFs are lightweight COFF-format modules commonly used by red-team frameworks including Cobalt Strike, Metasploit, Sliver, and Brute Ratel.

By embedding this capability, FamousSparrow can operationalize existing post-exploitation modules without dropping full executables to disk.

Government and critical-infrastructure defenders in the region should investigate unexpected DLL side-loading behavior, suspicious service creation, anomalous Run-key changes, in-memory PE execution, and unauthorized BOF-like activity.

Analysts should also scrutinize outbound TLS connections to unfamiliar IP-based infrastructure, particularly traffic on ports 443 and 8080, and compare telemetry with the indicators of compromise released by ESET.

The migration from SparrowDoor to SparroWocky demonstrates that FamousSparrow is modernizing its tooling while narrowing its operational focus.

The combination of memory-resident execution, red-team component reuse, stealthy persistence, and Windows internals manipulation makes the campaign a substantial espionage risk for Latin American public-sector networks.

IOCs

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC