From mid‑2025 into 2026, 90 percent of the Salt Typhoon crew’s targets were located in Latin America, ESET’s researchers report — a sharp pivot for the PRC‑backed espionage group long associated with stealthy intrusions of telecommunications and government networks.
Salt Typhoon’s Latin America pivot and the countries hit
ESET, which tracks the group as FamousSparrow, says the threat actor shifted its focus to Latin America in July 2025 and by August 2025 was deploying a newly discovered backdoor across the region. The company identified deployments against government agencies in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela. ESET’s analysts describe this level of regional concentration as “a rare occurrence among the China‑aligned APT groups.”
Analysts Alexandre Côté Cyr and Romain Dumont wrote that the activity “is intended to help China better monitor and anticipate the reaction of local governments to current US pressures,” tying the targeting to what they called “an aggressive reaffirmation of US interests in Latin America” during Donald Trump’s second presidential term.
SparroWocky: a modular C++ backdoor built from open source parts
ESET named the new implant SparroWocky. The backdoor is a modular C++ program that, according to ESET’s analysis of a sample compiled on November 17, integrates several open source components: Mbed TLS for establishing secure channels; MinHook, a Windows API hooking library; and a COFF Loader (or a similar project) to dynamically load and execute in‑memory plugins as COFF objects. The researchers found the first stanza of Lewis Carroll’s “Jabberwocky” embedded in multiple samples, from which they derived the malware’s name.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageEvasion techniques: API hashing, MinHook hiding, and stack spoofing
SparroWocky combines off‑the‑shelf tools with custom evasion. It implements a custom API‑hashing algorithm to resolve Windows API functions at runtime and uses MinHook to hide the start address of newly created threads from security products. ESET also observed a variant of the SilentMoonwalk technique in the samples, used to spoof call stacks that originate from MinHook routines so monitoring tools are less likely to flag malicious activity.
Deployment and command capabilities: trident loader, DLL side‑loading, and WinHandler
The gang deploys SparroWocky via its established trident loader scheme: a legitimate executable, a malicious DLL, and an encrypted payload file. The loader lives in the malicious DLL and runs through DLL side‑loading. Once the backdoor establishes contact with its command‑and‑control (C2) server, it uses TLS to communicate directly to C2 IP addresses — generally on port 443, though ESET also saw connections on port 8080.
Runtime type information in the binary shows a custom ServerHandler‑derived class named WinHandler processing nearly 30 commands. Those commands include: collecting and exfiltrating system details; starting or terminating sessions and removing persistence; stealing and deleting files; taking periodic screenshots; enumerating remote sessions and harvesting session IDs and usernames via WTSEnumerateSessionsW; and spawning additional SparrowWocky instances. ESET has published a full indicators‑of‑compromise list and sample files in its GitHub repository.
What this means for technologists, policymakers, and affected enterprises
- Technologists and security teams: The mix of open source components and in‑memory COFF plugin loading increases the importance of endpoint telemetry that can detect anomalous thread starts, hooking behavior, and unusual in‑memory module execution. ESET’s published IoCs and samples provide immediate artifacts defenders can integrate into detection rules and threat hunting.
- Policymakers and regulators: The concentration of intrusions against government bodies across multiple Latin American countries — and the stated intelligence aim of monitoring local governments’ responses to geopolitical pressure — will raise questions about regional information‑security cooperation and whether new diplomatic or technical countermeasures are needed.
- Affected enterprises and procurement leaders: Telecommunications and other sectors previously targeted by Salt Typhoon should review DLL load paths and the presence of unsigned or weakly validated binaries in deployed environments; the trident loader technique underscores that legitimate executables can be abused as part of a persistent chain.
Salt Typhoon’s use of standard cryptographic libraries, common hooking tools, and a modular COFF plugin approach shows how a sophisticated espionage crew blends public‑domain projects with tailored techniques to evade detection. ESET’s publication of IoCs and samples is a concrete step defenders can act on today; whether the gang maintains this regional focus or adapts its toolset further is a question the telemetry community will be watching closely.
