"SparroWocky is a modular, C++ backdoor," ESET security researchers Alexandre Côté Cyr and Romain Dumont said in a technical report shared with The Hacker News.
SparroWocky: new primary implant with modular capabilities
The China-aligned, state-sponsored threat actor known as FamousSparrow has moved to a previously unreported backdoor named SparroWocky, according to ESET. The firm found the backdoor in attacks across multiple countries in Latin America and says the group replaced its prior implant, SparrowDoor, with SparroWocky as its primary tool. ESET assesses FamousSparrow has been active since at least 2019 and that SparroWocky has been observed in the wild since at least August 2025.
Technically, ESET describes SparroWocky as a modular C++ backdoor. Its documented capabilities include executing arbitrary files, operating as a TCP proxy, running commands, collecting general system information and the IP addresses of network interfaces, exfiltrating files, taking periodic screenshots, performing file operations, and removing itself from a compromised host.
Techniques: TLS, DLL sideloading, and integrated open-source components
SparroWocky makes extensive use of public projects to handle communications and evade analysis. ESET lists the following components observed inside the malware:
- Mbed TLS — used to establish a secure channel with the command-and-control server at 216.238.110[.]120 over TLS;
- MinHook — employed to hide the start address of newly created threads from security products;
- COFF Loader — enables dynamic loading and execution of in-memory plugins presented as COFF objects;
- A variant of SilentMoonwalk (also referred to as StackMoonwalk) — used to spoof call stacks that originate from MinHook routines.
ESET notes that, unlike earlier campaigns where open-source offensive tooling ran alongside the group’s backdoor, SparroWocky demonstrates FamousSparrow’s ability to integrate open-source code directly into a custom implant. The malware is triggered via a DLL sideloading chain: a legitimate executable launches a loader DLL that decrypts and launches the main payload. ESET records the initial access vector used in these attacks as unknown.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildTargets: governmental entities across Latin America
Beginning in July 2025, ESET observed a focused set of targets: governmental entities in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela. The company reports that 90% of the group’s targets recorded in its telemetry have been located in the Latin American region. ESET cautions that it is unclear whether this regional concentration reflects a formal geographic mandate for the actor or is a temporary focus governed by current geopolitical circumstances.
Attribution and actor behavior: overlaps with Earth Estries and Salt Typhoon
ESET describes FamousSparrow as China-aligned and state-sponsored and notes some level of overlap between FamousSparrow and two other tracked clusters, Earth Estries and Salt Typhoon. Beyond that linkage, the firm highlights continuity in underlying techniques despite the switch to a different malware family: DLL sideloading chains, use of open-source tooling, and anti-analysis measures tied into the implant.
What this means for technologists, policymakers, and affected governments
- Technologists and security teams — Watch for signs of DLL sideloading chains, MinHook-related hiding of thread start addresses, in-memory COFF plugin activity, and TLS connections to the C2 noted by ESET (216.238.110[.]120). The integration of open-source code into a custom backdoor suggests detection signatures tied only to separate public tools may miss integrated variants.
- Policymakers and regulators — The concentration of targets in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela and the company’s telemetry showing 90% regional targeting may require regionally coordinated responses or information-sharing focused on the same technical indicators and intrusion patterns.
- Affected governments and enterprise defenders in the named countries — The observed tradecraft (DLL sideloading, encrypted C2 over TLS, in-memory module loading) underlines the need to inspect legitimate executables and their loaded DLLs, and to correlate endpoint telemetry with unusual thread-creation and in-memory plugin activity.
FamousSparrow’s move to SparroWocky underscores an adversary evolving from reusing public offensive tools toward fusing those projects into a bespoke implant. As ESET puts it, "It is not clear whether the group’s apparent focus on Latin America may reflect a formal, geographical mandate, or whether this focus is only temporary and dictated by the current geopolitical circumstances." That ambiguity — about motive, scope, and longevity — remains the central puzzle left by the evidence.
https://thehackernews.com/2026/09/china-aligned-famoussparrow-deploys.html
