Chinese-Linked FamousSparrow Uses SparroWocky Backdoor to Target Latin American Governments

FamousSparrow, a Chinese-linked cyberespionage group, is using a new backdoor named SparroWocky to target government agencies across Latin America.

The campaign has been active for more than a year. SparroWocky has replaced the group’s previously used custom backdoor, SparrowDoor.

ESET researchers observed SparroWocky attacks against organizations in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela.

Researchers believe the attackers aimed to gather intelligence about Latin American governments’ responses to increasing US pressure on China’s economic interests.

SparroWocky is a modular C++ backdoor

ESET’s analysis found that SparroWocky is a modular, full-featured C++ backdoor containing code from an open-source project.

The malware uses anti-analysis techniques, including manipulation of low-level structures in memory and runtime code patching. Its capabilities include:

• Running commands and executables
• Loading beacon object files into memory and executing them
• Collecting system, network, user, domain, and Windows version information
• Enumerating drives, directories, files, displays, and active user sessions
• Uploading, downloading, copying, moving, renaming, and deleting files
• Capturing a screenshot every 500 milliseconds and sending only the screen area that changed after the initial full-screen image
• Creating a process in another logged-in user’s session
• Acting as a TCP proxy and forwarding connections
• Removing its persistence and deleting its own files

DLL sideloading and memory-based evasion

According to researchers, SparroWocky is deployed through DLL sideloading. The loader decrypts an RC4-encoded payload stored in a .dat file and maps it directly into memory to evade detection.

The malware also uses several other evasion techniques, including call-stack and threat-origin spoofing, dynamic API resolution, and disguising malicious in-memory code and DLLs as legitimate Windows components.

To conceal its activity from security software, SparroWocky intercepts the Windows thread-creation process and changes the thread’s starting address.

“SparroWocky hooks the CreateThread function using the MinHook library to hide the original lpStartAddress parameter from security products.

“Essentially, threads created by SparroWocky have AnimateWindow as the start address and may be considered legitimate by some security products.” ESET explains.

FamousSparrow persistence and command-and-control infrastructure

SparroWocky establishes persistence through a Windows service named ProcAuditManager or by adding a Windows registry key named SnapCart under HKLM or HKCU, depending on the permissions available.

The researchers said the malware’s architecture and evasion techniques “demonstrate anti-analytics tricks and extensive knowledge of Windows internals,” which is consistent with attribution to a well-resourced and experienced threat group.

During its analysis, ESET identified at least 18 command-and-control (C2) addresses communicating directly with the malware through ports 443 or 8080, or through HTTP and SOCKS5 proxies.

ESET telemetry indicates that since mid-2025, FamousSparrow has primarily focused on targets in Latin America.

ESET publishes SparroWocky indicators of compromise

ESET’s report includes a technical analysis of the SparroWocky backdoor and a list of indicators of compromise (IoCs) associated with the campaign.

Join Mikko Hypponen and security leaders from the NFL, Chanel, and Atlassian for a 2-hour digital summit about what will change with AI speed attacks, what defenders should stop doing, and how to verify, decide, fix, and revalidate at machine speed.

Please reserve your seat