FamousSparrow Deploys SparroWocky Backdoor in Latin America

• •FamousSparrow has transitioned to the SparroWocky backdoor, targeting Latin American governments.
• •SparroWocky employs advanced evasion techniques and integrates open-source code.
• •90% of FamousSparrow's targets are located in Latin America, reflecting a strategic shift.

The China-aligned cyberespionage group FamousSparrow has replaced its previous backdoor, SparrowDoor, with a new malware called SparroWocky, targeting governmental organizations in Latin America since August 2025. ESET Research attributes this campaign to a likely response to increased U.S. interests in the region. The malware, written in C++, features advanced evasion techniques and can execute commands, exfiltrate data, and load Beacon Object Files. Notably, 90% of the group's targets in ESET telemetry are located in countries like Argentina, Ecuador, and Venezuela. The malware is delivered via a DLL side-loading technique, utilizing a legitimate executable to launch a malicious DLL that decrypts the payload directly in memory. ESET has observed that SparroWocky incorporates code from open-source projects, marking a shift in the group's operational tactics. The group has been active since at least 2019 and is known for its sophisticated cyber-espionage campaigns.