China-Aligned Famous Sparrow Deploys Sparro Wocky Backdoor Across Latin America
Summary: ESET researchers reported that the China-aligned group FamousSparrow has deployed a previously unreported modular C++ backdoor called SparroWocky against targets in Latin America since at least August 2025, replacing SparrowDoor as its primary implant. The malware executes arbitrary files, acts as a TCP proxy, runs commands, exfiltrates files, takes periodic screenshots, and deletes itself, and is launched through a DLL sideloading chain as before.
What you should know: ESET says 90% of the group's targets in its telemetry are in Latin America, with the new backdoor deployed against governmental entities in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela - and the initial access vector remains unknown.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026