The China-linked cyberespionage group FamousSparrow has deployed a sophisticated new backdoor called SparroWocky in attacks targeting government organizations across Latin America.
Security researchers at ESET observed the malware in operations affecting organizations in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela. The campaign has been active for more than a year, with SparroWocky replacing the group’s previously known SparrowDoor backdoor. (BleepingComputer)
Researchers believe the campaign is focused on intelligence gathering. According to ESET’s assessment reported by BleepingComputer, the attackers appear particularly interested in understanding how Latin American governments are responding to increasing US pressure surrounding Chinese economic interests in the region. (BleepingComputer)
A Powerful New Espionage BackdoorSparroWocky is a modular backdoor written in C++ and equipped with extensive remote-control capabilities. Once installed, it gives attackers significant visibility and control over a compromised Windows system.
The malware can execute commands and programs, collect information about the computer and network, enumerate files and directories, manipulate files, inspect logged-in users, and capture screenshots. It can also operate as a TCP proxy and forward network connections, potentially helping attackers move deeper into compromised environments. (BleepingComputer)
Its screenshot functionality is particularly aggressive. SparroWocky can capture the screen every 500 milliseconds while optimizing transmission by sending only regions that have changed after the initial full screenshot.
The malware can also load and execute Beacon Object Files directly in memory, giving operators a mechanism for extending its capabilities without necessarily deploying conventional executable files to disk.
Designed to Avoid DetectionThe technical sophistication of SparroWocky is especially visible in its evasion mechanisms.
The malware is deployed using DLL side-loading, with a loader decrypting an RC4-encoded payload stored inside a.datfile. The payload is then mapped directly into memory.
SparroWocky also uses dynamic API resolution, call-stack manipulation and other techniques intended to make malicious activity resemble legitimate Windows behavior. (BleepingComputer)
One particularly interesting technique involves intercepting Windows thread creation. The malware hooks theCreateThreadfunction and manipulates information about where newly created threads appear to start.
As a result, security products inspecting those threads may see the legitimate WindowsAnimateWindowfunction as their starting point rather than the actual malicious code.
The combination of memory manipulation, runtime patching and Windows internals demonstrates that the malware was designed with defensive security products firmly in mind.
Persistence and Command-and-ControlSparroWocky can establish persistence through a Windows service namedProcAuditManageror through a registry entry calledSnapCart, depending on the privileges available on the compromised machine.
Researchers also identified at least 18 command-and-control addresses associated with the operation. Communications can occur directly over ports 443 and 8080 or through HTTP and SOCKS5 proxies. (BleepingComputer)
These proxy capabilities are important in espionage operations because attackers often need to maintain long-term access while minimizing suspicious direct connections between compromised systems and external infrastructure.
ESET’s telemetry indicates that FamousSparrow has concentrated much of its activity on Latin American targets since approximately mid-2025.
Latin America Becomes a Major Espionage TargetThe campaign highlights how geopolitical competition increasingly translates into cyber operations against government infrastructure.
Instead of immediately encrypting systems or demanding money, espionage groups typically prioritize remaining undetected while collecting information over extended periods. A flexible backdoor such as SparroWocky provides exactly that capability.
Its ability to execute code, monitor users, capture screens, manipulate files and proxy network traffic could allow operators to quietly observe sensitive government activity while expanding their access.
For defenders, the campaign also demonstrates why detecting sophisticated espionage operations cannot depend entirely on identifying known malware files. SparroWocky’s extensive use of memory execution, DLL side-loading and anti-analysis techniques is specifically designed to reduce those opportunities.
The discovery of SparroWocky therefore provides another example of how advanced threat groups are combining custom malware with increasingly sophisticated techniques for hiding malicious execution inside apparently legitimate Windows activity.
Original report from BleepingComputer