FamousSparrow is linked to Salt Typhoon
Assessment
This linkage has circulated publicly and at least one outlet covering ESET's September 2026 SparroWocky research used a headline directly attributing the new backdoor to Salt Typhoon. ESET, the researchers who authored the primary technical analysis and who have tracked FamousSparrow since 2019, explicitly states in that same report that FamousSparrow "has also been publicly linked to Salt Typhoon, but, due to the absence of any technical indicators, we track them as separate." The primary source directly disputes the linkage that downstream headlines assert as fact.
Where this claim appeared
uk.headtopics.com (aggregating Salt Typhoon framing); disputed by ESET Research · 2026-09-17
https://www.welivesecurity.com/en/eset-research/beware-sparrowock-backdoor-bites-commands-catch/What “Weak Evidence” means
Evidence exists but is thin, circumstantial, or explicitly qualified as weak by the source that published it. Shared hosting infrastructure between threat clusters is the recurring example.
3 of 5 · rating scale
Assessed in
FamousSparrow's SparroWocky Backdoor Targets Latin American Governments Amid US-China RivalryThink this assessment is wrong? Report an error.