FamousSparrow Uses SparroWocky Against Latin America

Attack chain and TTPs

The attack chain that can be reconstructed from the material does not include a public exploit step by step or a published IOC list, but it does show a clear operational architecture. The most cited initial access vector is vulnerable Microsoft Exchange servers. From there, the actor deploys SparroWocky, a modular C++ backdoor designed to maintain persistent access, remote control, and discreet espionage.

Modularity matters because it allows functions to be packaged without unnecessarily bloating the implant’s core. ESET and technical outlets describe a component that can execute arbitrary commands, launch files, operate as a TCP proxy, and collect host and network-interface information. It can also exfiltrate files, take periodic screenshots, manipulate files, and erase its own presence from the compromised system.

BleepingComputer added that the code incorporates components from open source projects. That can broaden capabilities and also introduce noise for analysis and signature-based detection. SocPrime added two traits that reinforce stealth, stack spoofing and reflective loading in memory, both consistent with a design meant to complicate process tracing, memory inspection, and traditional telemetry.

The replacement of SparrowDoor with SparroWocky suggests that FamousSparrow opted for a more flexible implant to support a long-running regional objective. The material does not support a single universal infection flow, but it does show a repeated logic, initial access, backdoor deployment, environment reconnaissance, collection of sensitive information, file transfer, and selective cleanup.

Regional impact

The operation shows an unusual concentration in Latin America and, within that region, a clear bias toward government entities. ESET said that about 90% of the targets observed in its telemetry between mid-2025 and 2026 were located in the region. Some coverage, including Cyware, also said the focus extended to telecommunications in Argentina, Ecuador, and Venezuela.

The strongest reading of the material is that the campaign was not episodic. It lasted for months, changed implants, and kept the same core interest, access to state networks and extraction of sensitive information. That persistence explains why so many separate outlets, even with different names for the actor, end up describing the same victim surface.

Regional overview

ESET reported activity against government entities in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela, and said SparroWocky had been deployed since at least August 2025. ZeroHour consolidated the same list of countries in its timeline, while Infosecurity Magazine, BleepingComputer, The Hacker News, and GBHackers repeated the victim set and the campaign’s persistence.

The sectoral relevance is centered on the public sector, although Cyware added telecommunications as a second front. The evidence does not support extending the scope to other sectors with the same confidence. The material also does not provide victim counts by country, so the geographic spread should be treated as an observed concentration, not an exhaustive tally.

Argentina

Argentina is among the countries where ESET observed SparroWocky in attacks against government organizations. The country appears repeatedly in coverage from Infosecurity Magazine, BleepingComputer, The Hacker News, GBHackers, CyberInsider, ZeroHour, and The Register, always within the same regional campaign attributed to FamousSparrow.

Peru

Peru appears explicitly in ESET’s report and in virtually all technical follow-up coverage. The material places it among the countries affected by SparroWocky deployments against government entities since August 2025. The Record added that Alexandre Côté Cyr’s tracking of the campaign reached government departments in Peru, along with other countries in the region.

Ecuador

Ecuador is part of the set of countries where ESET observed the backdoor. Cyware also mentioned it in its September 18, 2026, bulletin when describing the shift in focus toward Latin America, along with Argentina and Venezuela. No additional verifiable details are available in the consolidated material about specific Ecuadorian entities.

Guatemala

Guatemala appears on the list of government entities affected by SparroWocky. The overlap among ESET, BleepingComputer, Infosecurity Magazine, The Hacker News, ZeroHour, and The Record reinforces that it was one of the confirmed targets in the regional campaign.

Honduras

Honduras also appears among the countries where the backdoor was observed against public agencies. The mention is consistent across the main follow-up reports derived from ESET’s research and is not paired with a verifiable sector beyond the state focus.

Panama

Panama appears repeatedly on the list of countries attacked. The material includes it both in ESET’s roster and in specialist summaries, always under the same espionage pattern against government entities.

Puerto Rico

Puerto Rico appears as a target in the consolidated material and is treated by ESET and related coverage as part of the Latin American theater of the campaign. The Record and ZeroHour include it in their lists, alongside Argentina, Guatemala, Honduras, Panama, Peru, and Venezuela.

Venezuela

Venezuela appears in ESET’s cited telemetry and in several later reports. Cyware also mentions it in the context of the shift toward Latin America, along with Argentina and Ecuador, although that strategic reading is the outlet’s interpretation rather than a primary finding in the technical report.

Chile

No specific facts were verified about Chile in the material provided.

Paraguay

No specific facts were verified about Paraguay in the material provided.

Bolivia

No specific facts were verified about Bolivia in the material provided.

Colombia

No specific facts were verified about Colombia in the material provided.

Brazil

No specific facts were verified about Brazil in the material provided.

Mexico

No specific facts were verified about Mexico in the material provided.

United States

No specific facts were verified about the United States as a direct victim in the material provided. The country appears only as contextual reference in some coverage about Chinese investments and in the strategic reading by Cyware and DarkReading, not as a confirmed target of the campaign.

The countries without additional verifiable coverage in the material are Chile, Paraguay, Bolivia, Colombia, Brazil, and Mexico.

Technical indicators

No concrete IOCs were published in the consolidated material. There are no hashes, domains, IPs, file paths, or mutex names that can be verified from the sources provided. The technical reading therefore has to rest on TTPs and behavioral identification, not on a list of specific indicators.

Analysis for security teams

The immediate priority for defenders in Latin American government organizations is to review Microsoft Exchange exposure and abuse, because that is the initial vector consistently mentioned in the material. Any exposed or poorly patched instance deserves urgent review. The fact that the campaign has remained active since August 2025 and is still appearing in September 2026 suggests this is not a closed incident, but an operational capability the actor sustained over time.

For detection, the focus should be on patterns consistent with modular backdoors, not only on static signatures. SparroWocky can execute arbitrary commands, launch files, act as a TCP proxy, collect host data, take screenshots, exfiltrate files, and self-delete. That combination calls for process telemetry, anomalous outbound connections, unexpected screen-capture activity, and events involving mass access or reading of sensitive files.

The mention of open source components and techniques such as stack spoofing and reflective loading means defenders need a broader view. An EDR that depends only on process names or exact hashes will fall short against a modular family that blends in with legitimate libraries and in-memory loading or injection techniques. Hunting should focus on process trees, lateral connections, service abuse, and file movements that match exfiltration phases.

From a prioritization standpoint, government teams in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela should treat this as persistent espionage, not a one-off outbreak. The coverage is consistent that the main target is the public sector, with a possible second focus on telecommunications. That justifies reviewing privilege controls, segmentation, mail exposure, network ingress and egress monitoring, and alerts for unusual screen capture or packaging of documents.

It is also worth adjusting detection to avoid naming confusion. WindowsForum warns that some publications mislabeled the campaign as Salt Typhoon. If internal rules or playbooks use the wrong name, response can be incomplete. The most consistent operational reference in the material is FamousSparrow, with SparroWocky as the main backdoor.

Frequently asked questions

Is the campaign attributed by ESET to FamousSparrow still active, and where was it seen?

Yes. The consolidated material indicates activity from at least August 2025 through September 2026, with observations in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela. That timeline runs across the Operation timeline and Regional impact sections.

What technically changed between SparrowDoor and SparroWocky?

SparroWocky became the group’s main backdoor rather than a minor variant. Unlike SparrowDoor, it is described as a modular C++ malware with command execution, TCP proxying, exfiltration, screenshot capture, and self-deletion. That crosses the Attack chain and TTPs and Context and background sections.

Which sectors were most exposed according to the material?

The public sector is the clearest documented target. ESET and the reporting based on its research describe attacks against agencies and government organizations, and Cyware adds telecommunications in some countries. This crosses Regional impact, Regional overview, and the Key facts table.

Which country appears most clearly in the coverage besides Argentina?

Peru appears explicitly and repeatedly in ESET, Infosecurity Magazine, BleepingComputer, The Hacker News, GBHackers, ZeroHour, and The Record. The mention crosses Regional impact, the Key facts table, and the Operation timeline, where it appears as a confirmed target in the regional set.

What kind of detection should be prioritized if no IOCs were published?

Behavior-based detection should be prioritized, especially Exchange abuse, unusual remote execution, TCP proxying, unexpected screenshots, file exfiltration, and evasion techniques such as reflective in-memory loading. That crosses Technical indicators with Analysis for security teams and Attack chain and TTPs.

Material limitations

The material provided does not include verifiable IOCs, hashes, domains, IPs, file names, or EDR signatures. It also does not allow a full infection chain to be reconstructed with a confirmed public exploit, nor does it let analysts attribute successful exfiltration to a specific victim with precision. Some secondary reports offer geopolitical interpretation about motives, but those readings are attributed to each outlet and not presented as primary facts in ESET’s report.

Sources and brief coverage for follow-up