FamousSparrow's SparroWocky Backdoor Targets Latin American Governments Amid US-China Rivalry

Executive Summary

On September 17, 2026, ESET Research published a detailed technical analysis of SparroWocky, a new modular C++ backdoor developed by the China-aligned cyberespionage group FamousSparrow, which has replaced the group's longtime flagship implant, SparrowDoor.¹ ESET has tracked FamousSparrow since at least 2019 and first publicly documented it in September 2021 after observing it exploit the ProxyLogon Microsoft Exchange vulnerability; the group's earlier targeting spanned hotels, governments, international organizations, trade groups, engineering firms, and law firms worldwide.¹

Since July 2025, FamousSparrow has pivoted to almost exclusively targeting government organizations in Latin America: from mid-2025 into 2026, 90% of the group's targets recorded in ESET's telemetry were located in the region, deployed against governmental entities in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela.¹ ESET assesses this is not coincidental, but likely reflects China's effort to monitor and anticipate how Latin American governments will respond to the current US administration's renewed strategic and economic engagement in the region, which threatens long-cultivated Chinese investments in energy, mining, and telecommunications.¹ ESET points to one specific, corroborating case: a targeted Panamanian entity directly involved in a commercial dispute over two ports in the canal area, previously operated by a China-based company whose concession was legally challenged by Panama's government in early 2025.¹

SparroWocky is a distinct malware family, not a variant of SparrowDoor, built with modularity and anti-analysis sophistication in mind: it manipulates low-level memory structures, patches code at runtime, spoofs call stacks to disguise malicious function calls, and can load and execute Beacon Object Files (BOFs) — a Cobalt Strike-originated executable format now used broadly across the red-teaming and offensive-security tooling ecosystem — letting the group repurpose publicly available offensive-security modules inside its own malware.¹² ESET attributes the campaign and the new backdoor to FamousSparrow with high confidence, based on SparroWocky being deployed by the FamousSparrow-exclusive SparrowDoor in early attacks and on matching victimology against organizations previously targeted with SparrowDoor.¹

Verification of Claims

1. Claim: SparroWocky is a distinct malware family from SparrowDoor, not a new version of it. → Verified — stated directly by ESET, whose researchers explicitly distinguish the two and note SparroWocky was largely built from the ground up.¹²

2. Claim: SparroWocky supports loading and executing Beacon Object Files (BOFs). → Verified — documented in ESET's technical analysis (command 0x14) and confirmed in an interview with ESET researcher Alexandre Côté Cyr.¹²

3. Claim: FamousSparrow is the same actor as, or is directly affiliated with, Salt Typhoon. → Unverified / disputed by the primary researcher — ESET states FamousSparrow "has also been publicly linked to Salt Typhoon, but, due to the absence of any technical indicators, we track them as separate." At least one outlet covering this same ESET report used a headline conflating FamousSparrow's activity with Salt Typhoon directly.¹

4. Claim: FamousSparrow's Latin America campaign is "spying on US politics." → Partially verified / overstated by secondary coverage — ESET's own assessment is that the campaign targets Latin American government organizations to help China anticipate those governments' reactions to US pressure and initiatives in the region — not that FamousSparrow is targeting US political institutions or figures directly. At least one outlet's headline characterizes this as China "spying on US politics in Latin America," which goes beyond what ESET's report itself claims.¹³

Timeline

Attack Anatomy

Initial deployment

SparroWocky is deployed using what ESET calls a "trident" loader scheme: a legitimate executable, a malicious DLL standing in for one the executable legitimately requires, and a separate file holding an encrypted payload.¹ The malicious DLL is loaded via DLL side-loading; in most observed cases, FamousSparrow patches a legitimate DLL rather than writing an entirely new one, replacing part of its .text section with malicious code and redirecting the entry point into that patched region — preserving the file's original metadata and exported-function list to blend in with the legitimate binary and to make function-boundary analysis harder for automated tools.¹

Loading and payload decryption

The loader extracts a same-named .dat file containing a custom header (magic value 0x11328712), configuration size, payload size, and a 16-byte RC4 key, which decrypts the remainder of the file into SparroWocky's configuration and the backdoor executable itself.¹ The decrypted backdoor is a portable executable with its MZ/PE header magic values stripped and is reflectively mapped directly into memory without ever being written to disk — an apparent attempt to defeat in-memory scanners that rely on simple PE-signature pattern matching.¹

Persistence

Depending on configuration, SparroWocky installs either as a Windows service (observed service/display name ProcAuditManager, described as tracking "process creation, termination, and related system audit events") or as a Registry Run key entry (observed value name SnapCart, under SOFTWARE\Microsoft\Windows\CurrentVersion\Run, in HKLM or HKCU depending on privilege level).¹

Command and control

The backdoor connects to its C2 server over TLS on port 443, using the open-source Mbed TLS library to establish the channel.¹ It supports direct connection, use of the system proxy, HTTP proxy (Negotiate or Basic auth), or SOCKS5 proxy, and can itself act as a TCP proxy for the attacker.¹ Once connected, it runs an infinite command loop handling instructions such as: collecting host/network fingerprint data, starting a new interactive session, terminating, removing persistence and terminating, and — notably — loading a Beacon Object File into memory and invoking a specified exported function with attacker-supplied arguments.¹ Exfiltrated data is encrypted with RC4 before being sent.¹

Anti-analysis techniques

SparroWocky uses the open-source MinHook library for Windows API hooking, paired with a variant of the SilentMoonwalk/StackMoonwalk technique to spoof call stacks originating from MinHook's own routines — disguising sensitive API calls as if they came from a legitimate part of the program.¹² It also resolves Windows API functions dynamically via a custom API-hashing algorithm rather than static imports, and uses a COFF-loader-style component to support in-memory loading of BOF plugins.¹

Threat Actor Profile

Name: FamousSparrow Alignment: China-aligned cyberespionage group Active since: At least 2019 (ESET); first publicly documented September 2021 Attribution confidence: High confidence that the SparroWocky campaign belongs to FamousSparrow specifically — based on the FamousSparrow-exclusive SparrowDoor deploying SparroWocky in early observed attacks, plus matching victimology against organizations previously targeted with SparrowDoor.¹ Group-level attribution to a Chinese state nexus is treated by ESET as an established prior finding, not re-litigated in this report.

FamousSparrow was initially known for targeting hotels globally, later expanding to governments, international organizations, trade groups, engineering companies, and law firms; it is the only known user of the SparrowDoor backdoor.¹ It has been publicly linked by other researchers to two other tracked clusters: Trend Micro has linked it to Earth Estries, though ESET states "the exact nature of the link is not fully known," and it has also been publicly linked to Salt Typhoon — a link ESET explicitly does not endorse, tracking the two as separate due to the absence of supporting technical indicators.¹

Since pivoting to SparroWocky, FamousSparrow has begun incorporating open-source offensive-security tooling directly into its malware rather than deploying standalone tools alongside it, and has adopted BOF support to draw on the broader red-teaming tooling ecosystem originally built around Cobalt Strike.¹² ESET researcher Alexandre Côté Cyr suggested the shift away from SparrowDoor may reflect that malware family becoming too widely cloned and too easily detected after years of exposure.²

MITRE ATT&CK techniques:

Technical Indicators

c2:
  - ip: 216.238.110[.]120
    port: 443
    protocol: TLS (Mbed TLS)
persistence:
  service:
    name: ProcAuditManager
    display_name: ProcAuditManager
    description: "Tracks process creation, termination, and related system audit events."
  registry:
    key: 'SOFTWARE\Microsoft\Windows\CurrentVersion\Run'
    value_name: SnapCart
    hive: HKLM or HKCU (privilege-dependent)
payload_file_marker:
  magic_value: '0x11328712'
  extension: '.dat'
sample_analyzed:
  sha1: 44F0A22B143B79FA760BF31E14C8FFF714C8A2A1
  compile_timestamp: '2025-11-17'
  reported_version: '1.8'
open_source_components_embedded:
  - Mbed TLS
  - MinHook
  - "COFF Loader (or similar project)"
note: >
  ESET publishes a fuller IOC set and a SparroWocky payload-decryption script
  in its GitHub repository, referenced in the original research.

Legal and Regulatory Response

No government advisory, sanction, or law enforcement action specific to FamousSparrow or SparroWocky had been published as of this paper's research cutoff (September 18, 2026). The disclosure is vendor threat-intelligence research by ESET, which states it will continue monitoring the group's activity in Latin America.¹

Impact Assessment

• Confirmed: ESET telemetry documents SparroWocky deployment attempts against governmental entities in eight named jurisdictions (Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, Venezuela), with 90% of the group's overall recorded targeting in the mid-2025–2026 window located in Latin America.¹
• Reported: A Panamanian entity directly involved in the ports concession dispute was targeted; ESET assesses this as likely intended to give China early insight into Panama's negotiating position, though this is an analytical judgment rather than a confirmed intelligence outcome.¹
• Unknown: Whether any targeted network was successfully compromised versus only targeted with an intrusion attempt, the volume or sensitivity of any data exfiltrated, and whether the Latin America focus reflects a permanent mandate shift or a temporary, geopolitically driven reallocation of the group's resources — ESET explicitly states this is not yet clear.¹

Lessons and Defensive Recommendations

For SOC/defenders (especially government entities in the region):

• Hunt for Windows services or Run-key entries with generic, audit-sounding names (e.g., ProcAuditManager, SnapCart) that do not correspond to known-installed software.
• Flag DLLs whose exported-function metadata matches a known-legitimate library but whose .text section entry point falls outside the expected function boundaries — a detection approach specifically aimed at the trident/patched-DLL loader technique described here.
• Treat outbound TLS connections to 216.238.110[.]120:443 as a high-confidence compromise indicator.

For threat intelligence teams:

• Do not treat "linked to Salt Typhoon" as an established fact when citing FamousSparrow — the primary researcher tracking the group explicitly disputes this link for lack of technical evidence, even though it continues to circulate in secondary reporting.

For organizations tied to geopolitically sensitive infrastructure decisions:

• Entities directly involved in disputes or negotiations that intersect great-power economic interests (port concessions, mining rights, telecom infrastructure) should treat themselves as plausible espionage targets independent of their own size or profile, per the Panama case ESET highlights.

For leadership:

• BOF compatibility in newer malware families means offensive-security tooling built for legitimate red-teaming is now directly reusable by nation-state actors with minimal adaptation; defenses tuned only to detect "known malware families" rather than BOF-loading behavior generally will lag this trend.

Sources