China’s FamousSparrow hackers target Latin America with new backdoor
ESET links a new SparroWocky backdoor campaign against Latin American government agencies to Chinese espionage group FamousSparrow.
ESET researcher Alexandre Côté Cyr has tracked the campaign since at least August 2025, hitting government departments in Guatemala, Honduras, Puerto Rico, Panama, Venezuela, Peru and Argentina. The SparroWocky backdoor embeds a stanza of Lewis Carroll's "Jabberwocky," resists analysis, exfiltrates files and screenshots, and collects system information such as IP address and usernames. ESET attributes the operation to FamousSparrow, a Chinese espionage group active since at least 2019 and publicly linked to Salt Typhoon. The targeting is likely intended to help China anticipate Latin American government reactions to renewed US pressure in the region, including disputes over ports near the Panama Canal.
- SparroWocky backdoor used against government agencies in seven Latin American countries and territories
- ESET attributes the campaign to Chinese group FamousSparrow, active since at least 2019
- Backdoor exfiltrates files, takes screenshots, and collects IP addresses and usernames
- Motive tied to monitoring local government responses to US pressure on Chinese investments
- One Panama victim is involved in a commercial dispute over canal-area ports
- ATT&CK
- T1113 Screen CaptureT1041 Exfiltration Over C2 ChannelT1082 System Information DiscoveryT1033 Account Discovery
- Vendors
- ESET
- Products
- Windows
- Threat actors
- FamousSparrowSalt Typhoon
- Malware
- SparroWocky
From the original article
2 min read at therecord.mediaAlleged Chinese hackers are breaking into government agencies across Latin America using a new backdoor that researchers are calling “SparroWocky.”
therecord.media
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.