Targets in Latin America and the stated espionage objective
ESET observed the China-linked espionage group FamousSparrow using a new backdoor, SparroWocky, against government organizations across Latin America. The company lists victims in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela. ESET's telemetry indicates that, from mid-2025, FamousSparrow’s focus has been primarily on targets in the Latin America region.
According to the researchers, the threat actor’s objective was “to collect intelligence on Latin American governments’ responses to increasing U.S. pressure on Chinese economic interests.” The operations have been ongoing for more than a year and, in ESET’s assessment, the new backdoor replaced a previously used custom backdoor dubbed SparrowDoor.
SparroWocky: a modular C++ backdoor that reuses open-source code
ESET’s technical analysis describes SparroWocky as a modular, full-blown C++ backdoor that incorporates code taken from open‑source projects. The malware exposes a broad set of functions and capabilities, which ESET documents in detail.
- Run commands and executable files
- Load and execute Beacon Object Files (BOFs) in memory
- Collect system, network, user, domain, and Windows-version details
- Enumerate drives, directories, files, displays, and active user sessions
- Upload, download, copy, move, rename, and delete files
- Capture screenshots every 500 milliseconds, transmitting only changed screen regions after the first full-screen image
- Create processes in another logged-in user’s session
- Operate as a TCP proxy and forward connections
- Remove its persistence and delete its own files
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageEvasion, persistence, and deployment techniques
ESET documents multiple evasion mechanisms built into SparroWocky. Deployment begins with a loader that decrypts an RC4-encoded payload stored in a .dat file and maps that payload directly into memory to evade disk-based detection. The malware uses DLL side‑loading to execute its components.
Additional evasion methods include call stack and threat-origin spoofing, dynamic API resolving, and disguising malicious in‑memory code and DLLs as legitimate Windows components. To hide from security solutions, SparroWocky intercepts the Windows thread creation process and alters the start address so newly created threads appear to begin at AnimateWindow — a behavior ESET says would likely be considered legitimate by security products.
For persistence the malware installs either a Windows service named ProcAuditManager or writes a registry key named SnapCart under HKLM or HKCU, depending on the privileges the attacker has. ESET also notes that SparroWocky can explicitly remove its own persistence and delete files when instructed.
Command-and-control infrastructure and campaign footprint
While analyzing the activity, ESET found at least 18 command‑and‑control (C2) addresses communicating with the malware. Those C2 hosts were reached directly over TCP ports 443 or 8080, or indirectly through HTTP and SOCKS5 proxies, according to the report.
ESET’s telemetry and analysis place the campaign’s timeline at more than a year, with a marked regional focus since mid‑2025. The company published a technical analysis and a list of indicators of compromise (IoCs) associated with the activity.
What this means for technologists, policymakers, and regional governments
Technologists and security teams: ESET’s report provides concrete technical artifacts to watch for — RC4‑encoded payloads in .dat files, DLL side‑loading behaviors, MinHook hooking of CreateThread and altered thread start addresses, and the ProcAuditManager and SnapCart persistence names. The company’s published IoCs are intended to be used for detection and hunting.
Policymakers: ESET attributes the campaign’s objective to intelligence collection on government responses to “increasing U.S. pressure on Chinese economic interests,” a targeted motive the report highlights when assessing intent and selection of victims.
Regional governments: Organizations in the listed countries are identified targets in this campaign. The report documents both the technical means of compromise and the operational footprint, information that may guide incident response and cross‑agency information sharing within affected states.
ESET’s disclosure frames SparroWocky as a sophisticated, modular backdoor with layered evasion techniques and an explicit intelligence collection goal tied to geopolitical economic pressure. The company’s inclusion of IoCs and a full technical analysis closes one chapter: defenders have specifics. The open question the data leaves is whether FamousSparrow will retain its Latin America focus or expand the same toolset to other regions.
