The threat actor known as FamousSparrow has replaced its long-running SparrowDoor implant with a new backdoor called SparroWocky, and has been deploying it against governments across Latin America since at least August 2025.
ESET Research attributed the campaign to the China-aligned group with high confidence, partly because some of the earliest SparroWocky infections were delivered by SparrowDoor, which only FamousSparrow is known to use. It found the backdoor at government entities in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico and Venezuela.
From mid-2025 into 2026, 90% of the group's targets in ESET telemetry sat in the region. The company called that rare among the China-aligned groups it tracks, which are usually seen across several parts of the world over a period that long.
FamousSparrow gained access by exploiting publicly reachable Exchange servers.
A Distinct Family, Not a SparrowDoor Variant
ESET was explicit that SparroWocky is not a SparrowDoor variant but a separate family, though it carries over some of the older backdoor's functions.
The modular C++ backdoor can run commands, execute files, act as a TCP proxy, collect host and network details, exfiltrate files and take screenshots on a repeating cycle. Exfiltrated data is encrypted with RC4 and sent over TLS.
It also loads and executes Beacon Object Files (BOF), a format introduced in Cobalt Strike and since adopted by other red-teaming frameworks. ESET said that marks a shift: FamousSparrow previously ran open-source offensive tools beside its own malware and now builds its code into it.
The developers put significant effort into developing evasion capabilities. SparroWocky patches code at runtime, forges call stacks so Windows API calls appear to come from legitimate thread entry points, and hooks thread creation so its own threads report a harmless start address.
Read more on FamousSparrow: Chinese Spy Group FamousSparrow Back with a Vengeance, Targets US
Latin America the Primary Target
ESET said the group narrowed to almost exclusively targeting the region in July 2025, a month before SparroWocky appeared.
It assessed the focus as China's likely reaction to renewed US interest in the region under Donald Trump's second term, which ESET said could threaten Chinese investments built up over a decade in energy, mining and telecommunications.
One case appeared to support this assessment. A Panamanian entity ESET saw targeted is directly involved in the dispute over two major ports in the canal area, run until recently by a China-based company whose concession the Panamanian government challenged in early 2025.
ESET said it could not tell whether the regional focus reflects a formal geographic mandate or is temporary and driven by current circumstances.
The group has been active since at least 2019 and was first documented in 2021 exploiting ProxyLogon. Trend Micro has linked it to Earth Estries, though ESET said that link is not fully understood, and it tracks FamousSparrow separately from Salt Typhoon for want of technical indicators.