FamousSparrow replaces SparrowDoor with new SparroWocky backdoor in Latin American government espionage

ESET says the China-aligned FamousSparrow group has replaced its SparrowDoor implant with a previously unreported modular backdoor, SparroWocky, used since August 2025 in espionage attacks on government entities across eight Latin American countries,…

ESET researchers report that the China-aligned state-sponsored espionage group FamousSparrow — active since at least 2019 and overlapping with Earth Estries and Salt Typhoon — has replaced its SparrowDoor implant with a new modular backdoor, SparroWocky, against government entities in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela. The Hacker News dates the campaign to at least August 2025 (though its own points list say July 2025), BleepingComputer describes the attacks as year-long, and roughly 90% of the group's tracked targets from mid-2025 into 2026 were in Latin America. ESET links the targeting to regional competition over US influence, with the stated objective of gathering intelligence on Latin American responses to US pressure on Chinese economic interests. The sources disagree on initial access: Cyber Security News says FamousSparrow exploited publicly reachable Microsoft Exchange servers, GBHackers lists CVE-2021-26855 (ProxyLogon) in connection with the campaign, and The Hacker News says the initial access vector is unknown. SparroWocky — described as a modular C++ backdoor by BleepingComputer, The Hacker News, and GBHackers but as C-language by Cyber Security News, and as a new family rather than a SparrowDoor variant — is delivered via a three-component DLL side-loading chain: a legitimate executable, a malicious side-loaded DLL, and an RC4-encrypted payload mapped directly into memory. It supports command execution, file operations, screenshots, TCP proxying, data exfiltration, self-deletion, in-memory plugin loading and Beacon Object File execution, and API hashing, integrating Mbed TLS, MinHook, COFF Loader, and SilentMoonwalk-style call-stack spoofing; it hooks CreateThread so malicious threads appear as AnimateWindow. Persistence is achieved through a ProcAuditManager Windows service or the SnapCart registry Run key, and data is exfiltrated RC4-encrypted over TLS C2 channels on ports 443 and 8080. ESET tracked at least 18 C2 addresses and published IOCs including three C2 IP addresses and loader SHA-1 hashes.

• SparroWocky is a previously unreported modular backdoor that replaces SparrowDoor as FamousSparrow's primary implant; GBHackers stresses it is a new family, not a SparrowDoor variant.
• Language attribution differs: BleepingComputer, The Hacker News, and GBHackers describe SparroWocky as C++, while Cyber Security News calls it a modular C-language backdoor.
• Campaign timing: since at least August 2025 per The Hacker News' summary (its own points say July 2025); BleepingComputer describes year-long espionage attacks.
• Targets are government entities in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela; about 90% of FamousSparrow's tracked targets from mid-2025 into 2026 are in Latin America.
• Stated objective is intelligence on Latin American responses to US pressure on Chinese economic interests; ESET ties the targeting to regional competition over US influence.
• Initial access is disputed: Cyber Security News reports exploitation of publicly reachable Microsoft Exchange servers, GBHackers lists CVE-2021-26855 (ProxyLogon), and The Hacker News says the vector is unknown.
• Delivery uses a three-component DLL side-loading chain — a legitimate executable, a malicious side-loaded DLL, and an RC4-encrypted payload mapped directly into memory.
• Capabilities include command execution, file operations, screenshots, TCP proxying, exfiltration, self-deletion, in-memory plugin loading and Beacon Object File execution, and API hashing, using Mbed TLS, MinHook, COFF Loader, and…