[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fXEqHGKCprL5tlDNGdmFL9xYObn9bzpbtqDv8wiftIzw":3},{"article":4,"iocs":46},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":11,"url":12,"image_url":13,"published_at":14,"ingested_at":15,"relevance_score":16,"entities":17,"category_id":28,"category":29,"article_tags":33},"f9a96342-f676-44c2-a626-123a7af0403e","China-Aligned FamousSparrow Deploys SparroWocky Backdoor Across Latin America","china-aligned-famoussparrow-deploys-sparrowocky-backdoor-across-latin-america-f355c5","The China-aligned state-sponsored threat actor known as FamousSparrow has been observed deploying a previously unreported backdoor called SparroWocky in attacks targeting multiple countries in Latin America since at least August 2025. \"SparroWocky is a modular, C++ backdoor,\" ESET security researchers Alexandre Côté Cyr and Romain Dumont said in a technical report shared with The Hacker News","China-aligned threat actor FamousSparrow is deploying a new C++ backdoor named SparroWocky in Latin America since August 2025. The malware, which incorporates anti-analysis techniques and leverages open-source projects for communication and evasion, replaces the group's previous implant, SparrowDoor. Attacks have targeted governmental entities across multiple Latin American countries, with the initial access vector remaining unknown.","FamousSparrow deploys new SparroWocky backdoor in Latin America.","China-Aligned FamousSparrow Deploys SparroWocky Backdoor Across Latin America Ravie LakshmananSep 17, 2026Malware \u002F Cyber Espionage The China-aligned state-sponsored threat actor known as FamousSparrow has been observed deploying a previously unreported backdoor called SparroWocky in attacks targeting multiple countries in Latin America since at least August 2025. \"SparroWocky is a modular, C++ backdoor,\" ESET security researchers Alexandre Côté Cyr and Romain Dumont said in a technical report shared with The Hacker News ahead of publication. \"Its architecture and the techniques used by its authors indicate strong knowledge of anti-analysis tricks and Windows internals.\" SparroWocky is so named for the fact that early iterations of the malware have been found to contain the first stanza of Jabberwocky, a famous nonsense poem written by the English author, poet, and mathematician Lewis Carroll in around 1855. The latest findings from ESET indicate that the cyber espionage group, which shares some level of overlap with Earth Estries and Salt Typhoon, has replaced SparrowDoor with SparroWocky as its primary implant. The threat actor is assessed to be active since at least 2019. SparroWocky features the ability to execute arbitrary files, act as a TCP proxy, and run commands. It can also collect general information about the compromised machine and the IP addresses of its network interfaces, as well as exfiltrate files, take periodic screenshots, perform file operations, and delete itself from the host. Furthermore, it makes use of various public projects for communications and defense evasion - Mbed TLS, to establish a secure communication channel with its command-and-control (C2) server (\"216.238.110[.]120\") over TLS MinHook, to hide the start address of newly created threads from security products COFF Loader, to enable dynamic loading and execution of in-memory plugins in the form of COFF objects A variant of SilentMoonwalk (or StackMoonwalk), to spoof the call stacks originating from MinHook routines \"FamousSparrow still uses open-source offensive tooling for its own malicious ends,\" ESET said. \"Previously, these tools were mainly used side by side with the group's backdoor. With SparroWocky, we can observe that it also has the development capabilities to integrate open-source code directly into its own custom backdoor.\" Despite switching to a distant malware family, the underlying techniques remain the same. As observed in the case of SparrowDoor, the malware is triggered by means of a DLL sideloading chain. The legitimate executable is used to launch a loader DLL that then decrypts and launches the main payload. The initial access vector used in these attacks is unknown. What's more, FamousSparrow appears to be more focused on targeting high-profile entities across Latin America starting July 2025, with the new backdoor deployed against governmental entities in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela. ESET said 90% of the group’s targets recorded in its telemetry have been located in the region. \"It is not clear whether the group’s apparent focus on Latin America may reflect a formal, geographical mandate, or whether this focus is only temporary and dictated by the current geopolitical circumstances,\" the Slovak cybersecurity company said. Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. SHARE     Tweet Share Share Share SHARE  cyber espionage, Malware, Nation-State, Windows Security ⚡ Top Stories This Week OpenAI Agents Linked to RubyGems Campaign That Gained RCE on RubyDoc Servers GitLab CVSS 10 File-Read Flaw Draws In-the-Wild Probes After Disclosure Claude Used to Automate Exploitation and Data Theft Across Multiple Victims Attackers Chain JFrog Artifactory Flaws to Gain Admin Control and Plant Backdoors PaperCut Replaces Emergency Patches With Fixes for Two Actively Exploited Flaws Cisco FMC Flaws Exploited to Steal Credentials and Deploy Qilin Ransomware ThreatsDay: 200 Android Flaws, Browser-Built Phishing, 119K Scam Shops + 23 More Stories Check Point Discloses Two 9.8-Rated VPN Certificate Flaws Enabling Unauthenticated RCE Anthropic Discloses Fourth AI Hacking Incident Involving Claude Opus 4.6 Four Spy Groups Used the Same Chrome and Windows Exploit Kit Within a Week DeepSeek Harness Flaw Let AI Agents Disable Their Own File Sandbox Without Approval Chrome V8 Zero-Day Exploited in the Wild Enables Code Execution Inside Sandbox New cPanel Flaw Lets a Hosting Account With Mail Privileges Run Code as Root F5 BIG-IP APM Malware Injects a PHP Web Shell Into Memory, Evading Disk Scans Researcher Drops New Microsoft Defender PoC Showing ShieldBreak Patch Can Be Bypassed Microsoft Patches Record 974 Flaws, Including Two Exploited Windows Zero-Days ChatGPT Flaw Let a Planted Prompt Send a Victim's Gmail Data to Another Account WeChat Zero-Click Worm Took Over Accounts on iPhone and Android via Incoming Calls Fake IT Calls Target Executives in Microsoft 365 Data Theft and Extortion Attacks When the Whole Company Adopts AI: What It Does to Your SOC Your Critical Vulnerabilities Might Not Be Your Biggest Risk What It Took to Reach 1 Billion Build Manifests US Becomes Top Target in RMM Phishing Campaign Spanning 46 Countries Why Are So Many Security Professionals Keeping Breaches Quiet? The Economics of Dwell Time and Why AI Native SIEM Changes the Equation ⭐ Featured Resources Get the eBook: Map Enterprise AI Risk Across the Full Lifecycle Give SOC Analysts Visibility Into 90% of Attacks Within 60 Seconds Benchmark Your SOC's AI Adoption With the 2026 Security Operations Report Register for LDR516: Strategic Vulnerability and Threat Management at SANS DC Metro","https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002Fchina-aligned-famoussparrow-deploys.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEiOuXwG1YyG0uUU23HOcrfuGGEs6q0HvIDe8f7tcoTc3Vg049ITdUDCK_oyfFs8F68GEANNMqayc_75ARq5bBdbIu8qplp_nwC8hWxALOjCCGyf_Pb76GvNjEEfoWybq1nM9WXuxoPvYiRN_vJewkghj5IAYOaCh9JulsW4DnZLCEOhg_mXL_ykI0_oJwah\u002Fs1600\u002Fchinese-hackers.jpg","2026-09-17T10:05:45+00:00","2026-09-17T14:00:31.704827+00:00",8,[18,21,23,25],{"name":19,"type":20},"FamousSparrow","threat_actor",{"name":22,"type":20},"Earth Estries",{"name":24,"type":20},"Salt Typhoon",{"name":26,"type":27},"MinHook","product","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":28,"icon":30,"name":31,"slug":32},null,"Nation-state","nation-state",[34,36,41],{"category":35},{"id":28,"icon":30,"name":31,"slug":32},{"category":37},{"id":38,"icon":30,"name":39,"slug":40},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":42},{"id":43,"icon":30,"name":44,"slug":45},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[47],{"type":48,"value":49,"context":50},"ip","216.238.110.120","C2 server IP address"]