FamousSparrow's SparroWocky Backdoor Targets Latin American Governments

• •FamousSparrow's SparroWocky backdoor targets Latin American governments since August 2025.
• •The malware employs advanced anti-analysis techniques and is delivered via DLL side-loading.
• •ESET attributes the campaign to FamousSparrow with high confidence due to its operational history.

The China-aligned cyberespionage group FamousSparrow has deployed a new modular backdoor named SparroWocky, primarily targeting government organizations in Latin America since August 2025. ESET researchers report that 90% of the group's targets during this period were located in countries such as Argentina, Ecuador, and Venezuela. SparroWocky is a sophisticated C++ backdoor that incorporates anti-analysis techniques and can execute commands, steal files, and manipulate system information. The malware is delivered via a DLL side-loading method that involves a legitimate executable and a malicious DLL. ESET attributes this campaign to FamousSparrow with high confidence due to the malware's origins linked to earlier infections by the SparrowDoor backdoor. The group has shifted its focus to Latin America in response to increased U.S. interest in the region, aiming to collect intelligence on governmental responses to Chinese economic pressures. Current defenses should prioritize monitoring for unusual DLL side-loading and patching vulnerabilities in internet-facing systems.