China-Linked FamousSparrow Deploys SparroWocky Backdoor in Latin America
China-linked FamousSparrow targets Latin American governments with SparroWocky backdoor.
The threat actor FamousSparrow, believed to be linked to China, has been observed targeting government entities in Latin America. They are deploying a new C++ backdoor named SparroWocky, which is capable of exfiltrating files, capturing screenshots, and evading security measures.
AI summary of the linked source. Not reviewed by an editor. How this works
The lesson from this incident
Full lessonThe FamousSparrow threat actor, likely state-sponsored by China, has deployed a sophisticated C++ backdoor called SparroWocky against government entities in Latin America, enabling file exfiltration, screenshot capture, and active evasion of security tools. This campaign highlights the persistent risk of advanced persistent threats (APTs) targeting government infrastructure, particularly in regions that may have less mature cybersecurity defenses. The backdoor's ability to evade security measures suggests that traditional signature-based detection alone is insufficient against nation-state-level adversaries. Organizations must adopt layered defenses, behavioral monitoring, and rapid incident response capabilities to detect and contain such intrusions before sensitive data is exfiltrated.
What helps against this
How we list vendors
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Network detection and response (NDR)
Attackers moving between systems inside the network get seen.
- Threat intelligence
Attack campaigns reach your sector, suppliers or software before your team hears about them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — SparroWocky