The China-aligned state-sponsored threat actor known as FamousSparrow has been observed deploying a previously unreported backdoor called SparroWocky in attacks targeting multiple countries in Latin America since at least August 2025.
“SparroWocky is a modular, C++ backdoor,” ESET security researchers Alexandre Côté Cyr and Romain Dumont said in a technical report shared with The Hacker News ahead of publication. “Its architecture and the techniques used by its authors indicate strong knowledge of anti-analysis tricks and Windows internals.”
SparroWocky is so named for the fact that early iterations of the malware have been found to contain the first stanza of Jabberwocky, a famous nonsense poem written by the English author, poet, and mathematician Lewis Carroll in around 1855.
The latest findings from ESET indicate that the cyber espionage group, which shares some level of overlap with Earth Estries and Salt Typhoon, has replaced SparrowDoor with SparroWocky as its primary implant. The threat actor is assessed to be active since at least 2019.
SparroWocky features the ability to execute arbitrary files, act as a TCP proxy, and run commands. It can also collect general information about the compromised machine and the IP addresses of its network interfaces, as well as exfiltrate files, take periodic screenshots, perform file operations, and delete itself from the host.
Furthermore, it makes use of various public projects for communications and defense evasion –
- Mbed TLS, to establish a secure communication channel with its command-and-control (C2) server (“216.238.110[.]120”) over TLS
- MinHook, to hide the start address of newly created threads from security products
- COFF Loader, to enable dynamic loading and execution of in-memory plugins in the form of COFF objects
- A variant of SilentMoonwalk (or StackMoonwalk), to spoof the call stacks originating from MinHook routines
“FamousSparrow still uses open-source offensive tooling for its own malicious ends,” ESET said. “Previously, these tools were mainly used side by side with the group’s backdoor. With SparroWocky, we can observe that it also has the development capabilities to integrate open-source code directly into its own custom backdoor.”
Despite switching to a distant malware family, the underlying techniques remain the same. As observed in the case of SparrowDoor, the malware is triggered by means of a DLL sideloading chain. The legitimate executable is used to launch a loader DLL that then decrypts and launches the main payload. The initial access vector used in these attacks is unknown.
What’s more, FamousSparrow appears to be more focused on targeting high-profile entities across Latin America starting July 2025, with the new backdoor deployed against governmental entities in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela. ESET said 90% of the group’s targets recorded in its telemetry have been located in the region.
“It is not clear whether the group’s apparent focus on Latin America may reflect a formal, geographical mandate, or whether this focus is only temporary and dictated by the current geopolitical circumstances,” the Slovak cybersecurity company said.
