China-Aligned FamousSparrow Deploys SparroWocky Backdoor Across Latin America
-
FamousSparrow, a China-aligned state-sponsored threat actor, has been observed deploying a previously unreported backdoor dubbed SparroWocky in attacks against multiple countries across Latin America since at least August 2025.
According to ESET security researchers Alexandre Côté Cyr and Romain Dumont, SparroWocky is a modular backdoor written in C++. The findings were detailed in a technical report shared with The Hacker News.
Key points from the report:
- The threat actor is tracked as FamousSparrow and assessed to be aligned with Chinese state interests.
- The newly identified implant, SparroWocky, is modular and built in C++.
- Targeting has focused on multiple countries in Latin America.
- Activity has been ongoing since at least August 2025.
Readers running ESET telemetry or threat intelligence feeds should review their detections for this activity, particularly if they operate in Latin American regions or adjacent sectors historically targeted by FamousSparrow.
Source: The Hacker News
Does your organization have visibility into C++-based modular backdoors like SparroWocky, and if so, how are you detecting them?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login