Full Report
The China-aligned state-sponsored threat actor known as FamousSparrow has been observed deploying a previously unreported backdoor called SparroWocky in attacks targeting multiple countries in Latin America since at least August 2025. "SparroWocky is a modular, C++ backdoor," ESET security researchers Alexandre Côté Cyr and Romain Dumont said in a technical report shared with The Hacker News
Analysis Summary
# Main Topic
China-Aligned Threat Actor FamousSparrow Deploys New "SparroWocky" Backdoor in Latin America
## Key Points
- **New Malware Discovery:** A previously unreported modular C++ backdoor named "SparroWocky" has been discovered in active deployment since at least August 2025.
- **Strategic Shift:** FamousSparrow has replaced its previous primary implant, SparrowDoor, with SparroWocky.
- **Advanced Evasion Techniques:** The backdoor demonstrates a strong understanding of Windows internals and anti-analysis techniques, incorporating several public open-source offensive tools directly into its custom codebase.
- **Geographical Focus:** The campaign exhibits a significant focus on Latin America, with 90% of ESET's telemetry for this group located in the region.
## Threat Actors
- **Attribution:** FamousSparrow (a state-sponsored cyber espionage group aligned with China).
- **Overlaps:** The group shares tactical or infrastructure overlaps with threat groups Earth Estries and Salt Typhoon.
- **Activity History:** Active since at least 2019, with a primary motivation centered on cyber espionage.
## TTPs
- **Initial Access:** The specific initial access vector remains unknown.
- **Execution & Persistence:** Triggered via a DLL sideloading chain where a legitimate executable launches a loader DLL, which subsequently decrypts and executes the main SparroWocky payload.
- **Defense Evasion:**
- Utilizes **MinHook** to obscure the start address of newly created threads from security products.
- Employs a variant of **SilentMoonwalk** (or StackMoonwalk) to spoof call stacks originating from MinHook routines.
- **In-Memory Execution:** Integrates **COFF Loader** to enable dynamic loading and execution of in-memory plugins in the form of COFF objects.
- **Command and Control (C2):** Integrates **Mbed TLS** to establish secure, encrypted C2 communications over TLS.
- **Malware Capabilities:** Arbitrary file execution, TCP proxying, command execution, system and network interface information gathering, file exfiltration/operations, periodic screenshot capture, and self-deletion.
## Affected Systems
- **Target Sector:** Governmental and high-profile entities.
- **Geographic Scope:** Primarily Latin America, with confirmed targeting of entities in:
- Argentina
- Ecuador
- Guatemala
- Honduras
- Panama
- Peru
- Puerto Rico
- Venezuela
## Mitigations
*Note: The source article did not provide explicit mitigation actions or patch details. Based on the technical findings, the following standard defensive measures are recommended:*
- **DLL Sideloading Detection:** Implement monitoring for unusual or unsigned DLLs being loaded by legitimate, signed system or application executables.
- **Network Monitoring:** Monitor and restrict outbound TLS traffic to unverified or anomalous foreign IP addresses, specifically auditing connections to known malicious infrastructure.
- **Endpoint Detection & Response (EDR):** Deploy EDR solutions capable of inspecting memory space and detecting call stack spoofing or dynamic COFF loading techniques.
## Conclusion
FamousSparrow remains a sophisticated threat actor with evolving development capabilities, transitioning from using standalone open-source offensive tools to directly integrating open-source projects into their custom malware architecture. Their concentrated focus on Latin American government infrastructure highlights a sustained cyber espionage mandate in the region. Organizations in this geography should prioritize defense-in-depth strategies, focusing heavily on endpoint memory monitoring and strict validation of DLL execution chains.