A China-aligned cyber espionage group known as FamousSparrow has deployed a previously undisclosed backdoor called SparroWocky in attacks targeting Latin American nations since at least August 2025, according to a technical report published by ESET security researchers Alexandre Côté Cyr and Romain Dumont. The threat actor, which has been active since at least 2019 and shares overlap with Earth Estries and Salt Typhoon, has replaced its earlier SparrowDoor implant with SparroWocky as its main tool. The malware gets its name from early versions containing the opening stanza of "Jabberwocky," the nonsense poem written by Lewis Carroll around 1855.
SparroWocky is a modular backdoor written in C++ that can execute arbitrary files, function as a TCP proxy, and run commands on compromised systems. The malware collects basic machine information and network interface IP addresses, exfiltrates files, captures screenshots at regular intervals, performs file operations, and can remove itself from infected hosts. The backdoor integrates several open-source projects directly into its code, including Mbed TLS for encrypted command-and-control communications with the server at 216.238.110[.]120, MinHook to conceal newly created threads from security software, COFF Loader for dynamic execution of in-memory plugins as COFF objects, and a variant of SilentMoonwalk to spoof call stacks from MinHook routines. Like its predecessor SparrowDoor, SparroWocky is activated through a DLL sideloading chain, where a legitimate executable launches a loader DLL that decrypts and executes the main payload, though the initial access method remains unknown.
FamousSparrow has concentrated its operations on high-profile targets across Latin America starting in July 2025, with the new backdoor deployed against government entities in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela. According to ESET's telemetry data, 90% of the group's detected targets have been located in the Latin American region. The researchers noted that "the architecture and the techniques used by its authors indicate strong knowledge of anti-analysis tricks and Windows internals." ESET also observed that "FamousSparrow still uses open-source offensive tooling for its own malicious ends," but noted a shift in tactics: "Previously, these tools were mainly used side by side with the group's backdoor. With SparroWocky, we can observe that it also has the development capabilities to integrate open-source code directly into its own custom backdoor."
The integration of open-source offensive tools directly into SparroWocky's codebase demonstrates an evolution in FamousSparrow's technical capabilities, moving from simply using such tools alongside custom malware to embedding them within the backdoor itself for enhanced functionality and stealth. The malware's use of anti-analysis techniques and Windows internals knowledge reflects sophisticated development skills aimed at evading detection by security products through thread concealment and call stack spoofing. The Slovak cybersecurity company said "it is not clear whether the group's apparent focus on Latin America may reflect a formal, geographical mandate, or whether this focus is only temporary and dictated by the current geopolitical circumstances." The shift from SparrowDoor to an entirely different malware family while maintaining core deployment techniques suggests FamousSparrow is actively refreshing its toolset to stay ahead of defensive measures.
The concentration of attacks on Latin American government entities marks a significant geographic focus for the threat actor, though ESET researchers remain uncertain whether this represents a permanent strategic shift or a temporary response to current geopolitical factors. The deployment of a completely new backdoor family indicates FamousSparrow continues to invest in developing advanced capabilities while maintaining operational security through proven deployment methods. Organizations in the targeted region should watch for signs of DLL sideloading activity and unusual network connections to the identified command-and-control infrastructure. State-sponsored actors often adjust their operational tempo and geographic priorities based on strategic intelligence requirements that may not be immediately visible to outside observers. The capacity to seamlessly switch primary implants while maintaining operational effectiveness suggests a well-resourced adversary with long-term objectives in the region.