Chinese hackers use SparroWocky malware in govt espionage attacks
ESET reports China-linked FamousSparrow deployed a new modular backdoor, SparroWocky, in year-long espionage attacks on Latin American government organizations.
ESET researchers observed FamousSparrow using SparroWocky, a modular C++ backdoor replacing the earlier SparrowDoor tool, against government targets in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela. Deployed via DLL side-loading with an RC4-encrypted payload mapped in memory, it captures screenshots, acts as a TCP proxy, and hooks CreateThread so malicious threads appear as AnimateWindow. Persistence uses a ProcAuditManager Windows service or SnapCart registry key; ESET tracked at least 18 C2 addresses and published IoCs.
- SparroWocky is a modular C++ backdoor replacing FamousSparrow's earlier SparrowDoor.
- Deployed via DLL side-loading; RC4-encrypted payload mapped directly in memory.
- Hooks CreateThread to disguise threads as AnimateWindow; service and registry persistence.
- ESET tracked at least 18 C2 addresses over ports 443 and 8080 and published IoCs.
- Objective is intelligence on Latin American responses to US pressure on Chinese economic interests.
- ATT&CK
- T1574.002 Hijack Execution Flow: DLL Side-LoadingT1543.003 Create or Modify System Process: Windows ServiceT1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup FolderT1113 Screen CaptureT1090 Proxy
- Vendors
- ESET
- Products
- SparroWockySparrowDoor
- Threat actors
- FamousSparrow
- Malware
- SparroWocky
From the original article
2 min read at bleepingcomputer.com
The China-linked espionage group FamousSparrow has been using a new backdoor named SparroWocky in attacks on government organizations in Latin America. [...]
By Bill Toulas · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.