FamousSparrow Uses SparroWocky in Latin America

Executive summary

ESET has attributed with high confidence a cyberespionage campaign against Latin American governments to FamousSparrow, based on a new modular C++ backdoor called SparroWocky. Telemetry analyzed by the company between mid-2025 and 2026 shows that about 90% of the observed targets were in the region, with activity in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela.

The main technical shift is the replacement of SparrowDoor with SparroWocky. The new implant expands the group’s operational reach and raises the cost of detection. It is delivered through DLL sideloading, uses an RC4-encrypted .dat file that holds both configuration and payload, and loads reflectively in memory. That design keeps the backdoor off disk and makes inspection harder for tools that rely on classic Portable Executable patterns.

The malware’s toolset is broad. Sources agree that SparroWocky can run commands, launch files, open an interactive shell, act as a TCP proxy, exfiltrate data, take periodic screenshots, collect host and network information, and self-delete. It also executes Beacon Object Files in memory, allowing the operators to reuse modules built for offensive frameworks such as Cobalt Strike, Sliver, Metasploit, and Brute Ratel. Several analyses describe it as a separate malware family, not a simple linear evolution of SparrowDoor.

Public attribution also came with an important clarification. Although several media outlets initially linked the activity to Salt Typhoon, ESET says the public technical evidence is not enough to merge Salt Typhoon and FamousSparrow into a single group. WindowsForum and the Spanish version of WeLiveSecurity emphasize that distinction and warn against treating both names as one operation. In practice, that means the reports need to be read carefully: SparroWocky was tied with high confidence to FamousSparrow, while Salt Typhoon appears in some coverage as an editorial comparison, not as a conclusion confirmed by the public sample.

The regional context is widened by two Mirage Security campaigns published in September 2026. One targets Brazilian banks through phishing attachments disguised as résumés, tunneling tools, and remote access malware. The other, identified as CL-CRI-1131, focuses on Mexico with living-off-the-land scripts, data exfiltration, and an AI chatbot called NextChat deployed on infrastructure controlled by the attackers. There is no evidence in the material that either campaign is part of the same cluster as SparroWocky, but they show a region where state espionage, multistage phishing, reusable tooling, and operational AI all coexist.

Context and background

FamousSparrow had already appeared in technical literature as a China-aligned espionage actor, but ESET’s September 2026 report gave that picture far more detail. Telemetry collected since mid-2025 showed a clear shift toward Latin America, which accounted for roughly 90% of the targets observed by the company. That figure underpins the regional nature of the campaign and explains why so many secondary reports repeat the same country list.

The most important detail is not just the volume of targets, but the pattern. The observed victims were government entities, not a scattered set of private companies. Targeting state bodies points to intelligence collection, long-term access, and communications monitoring, not an opportunistic monetization campaign. Dark Reading adds an interpretive layer by saying the campaign is aimed at agencies tied to Chinese investments and political issues involving the United States. That is an analytical reading, not an extra attribution, but it helps explain the strategic interest in the region.

SparroWocky replaced SparrowDoor as the group’s main implant. ESET, Infosecurity Magazine, WeLiveSecurity, The Register, CyberInsider, Mallory.ai, and other secondary analyses all confirm that shift. The overlap across sources suggests this was not an isolated sample, but an update to the group’s operational line. From a defensive standpoint, that matters because each implant change alters artifacts, detection patterns, and in-memory behavior.

The public discussion was also complicated by a naming mix-up. Some media coverage used the Salt Typhoon label, while ESET kept FamousSparrow and Salt Typhoon separate because there are no technical indicators proving they are the same operation. WindowsForum makes that point explicitly, and WeLiveSecurity repeats it in Spanish. The practical takeaway is simple: names should not be merged automatically in internal rules, reports, or attribution matrices.

In parallel, Mirage Security published two intrusion studies that are not attributed to the same actor, but still help frame regional trends. In Brazil, case CL-CRI-1163 describes a multistage operation against the financial sector. In Mexico, cluster CL-CRI-1131 combines living-off-the-land techniques, exfiltration, and an infrastructure exposing NextChat, an AI chatbot the attackers used to debug and generate scripts. That second case is especially relevant because it shows a hybrid offensive environment, with automation and accidental exposure of attacker assets.

Key facts table

Operation timeline

Attack chain and TTPs

SparroWocky is built to arrive through DLL sideloading and stay in memory. The sequence described by Cloud Security Alliance and Mallory.ai combines a legitimate executable, a malicious patched DLL, and an RC4-encrypted .dat file that holds both configuration and payload. The loader reads that file, decrypts both components, and executes them reflectively, without writing the backdoor to disk.

That mechanism has two practical effects. First, it reduces forensic footprint, because the main sample lives in memory and does not necessarily appear as a recoverable binary in the file system. Second, it gives operators flexibility, since configuration, modules, or parameters can change without rebuilding the entire chain. HackRead adds that the PE payload may load with its MZ and PE headers removed, which makes memory scanning harder.

Persistence is implemented in two ways, depending on the configuration observed. The implant can create a Windows service or a Run key in the registry. That dual path lets operators adapt to host controls and to the level of stealth they want. In monitored environments, finding these keys alongside unusual DLL paths can be more useful than looking only for the backdoor binary.

The functional set is wide. ESET, Infosecurity Magazine, The Hacker News, Cyware, and Mallory.ai agree that SparroWocky can run commands, launch files, interact with a shell, exfiltrate files, list disks, folders, files, screens, and user sessions, take periodic screenshots, and act as a TCP proxy. It also includes reverse port forwarding and a self-destruction mechanism. In capability terms, this is not a minimal implant but a full remote operations platform.

Visual surveillance deserves its own note. BleepingComputer documented that the malware takes screenshots every 500 milliseconds and, after the first full image, sends only the changed regions. That optimization reduces bandwidth use and lowers network noise. For defenders, the result is a quieter espionage session than a simple raw screenshot dump.

SparroWocky also borrows code and techniques from existing projects. Several sources point to Mbed TLS for encrypted communications, MinHook for API hooking, and evasions associated with SilentMoonwalk and call-stack spoofing. CyberInsider and Offseq Radar add that the backdoor integrates Beacon Object Files and loads modules associated with Cobalt Strike, Metasploit, Sliver, and Brute Ratel. That suggests a modular attack chain, with offensive tooling reuse and a fairly mature integration layer.

TTPs observed in SparroWocky

Regional impact

Regional overview

The geographic impact is clear. The SparroWocky campaign concentrates on Latin American governments and places the region at the center of ESET’s observed telemetry. The material does not show a uniform spread, but a pattern dominated by public-sector entities and a persistent timeline extending from at least August 2025 through September 2026.

The country list appears repeatedly across multiple outlets and matches ESET’s publication: Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela. That repetition gives the fact set more weight. It also supports an operational reading: this is not a mass opportunistic campaign, but a sustained effort to access specific government networks.

One methodological point should be stated clearly. WindowsForum notes that ESET’s public report does not name specific agencies or the number of compromised endpoints. So the evidence confirms targeting and malware deployment, but not broad compromises across every government. That distinction between observed targets and the actual scope of the incident matters for any internal assessment.

Argentina

Argentina appears consistently in the list of victims observed by ESET and in coverage from Infosecurity Magazine, The Register, BleepingComputer, Dark Reading, TechRadar Pro, and other secondary outlets. The pattern is the same as in the rest of the region, with focus on government entities and use of the SparroWocky backdoor for sustained access.

Cyware and WindowsForum reinforce that point by including Argentina among the Latin American governments affected by the campaign while also warning that the public attribution remains FamousSparrow, not an automatic merge with Salt Typhoon. For an Argentine defense team, the useful takeaway is twofold: the implant’s presence is plausible, and attribution needs to remain precise.

Peru

Peru appears repeatedly in the material as one of the countries observed by ESET. The Manila Times, The Record, BleepingComputer, Infosecurity Magazine, TechRadar Pro, CyberInsider, WBOC, and Offseq Radar all include it among the governmental targets of SparroWocky. That indicates the campaign was neither marginal nor isolated in the country, but part of the same regional intrusion series.

The repeated mention of Peru in technical and general-interest outlets also suggests continuity over time. The Record places the tracking back to at least August 2025, while TechRadar Pro describes activity between mid-2025 and 2026. From a defensive standpoint, that means the campaign should be treated as prolonged, not as a one-off event.

Mexico

Mexico does not appear in ESET’s telemetry on SparroWocky, and WindowsForum and the Spanish version of WeLiveSecurity state that explicitly. However, Mirage Security documents a separate cluster with a Mexico focus, CL-CRI-1131, which uses living-off-the-land techniques, exfiltration tools, and an infrastructure exposing NextChat, an AI chatbot used to debug and generate scripts.

That case should not be confused with FamousSparrow. The material does not attribute CL-CRI-1131 to that group or to the SparroWocky backdoor. Its value is that it shows a second line of pressure on the region, different from the government espionage campaign but still relevant to Mexico because of the use of native scripts and the accidental exposure of offensive infrastructure.

Brazil

Brazil appears in the material through Mirage Security’s study of a multistage campaign against banks and other financial entities. There the attackers used phishing attachments disguised as résumés, downloaded and executed tunneling tools and remote access malware, and operated in a separate cluster with no public attribution to a specific state actor.

That case is useful as a contrast. While SparroWocky is aimed at Latin American governments, the Brazilian cluster targets the financial sector. Looking at both cases together shows that the region is being hit by campaigns with different goals, vectors, and levels of maturity, which means controls need to be segmented rather than treating every regional intrusion as the same pattern.

United States, Puerto Rico

Puerto Rico appears in ESET’s target list as a territory of the United States. In the available material, the interest in Puerto Rico is not presented as a separate campaign, but as part of the same set of government intrusions across Latin America. That inclusion matters because it extends the geographic impact beyond South and Central America.

The rest of the United States does not appear in the published telemetry for SparroWocky. Puerto Rico’s presence does not change the regional character of the case, but it does show that the espionage reach is not limited to sovereign states on the continent. It also explains why some English-language coverage mixes Latin America with U.S. territories when describing the case.

Countries without specific verifiable coverage

No additional verifiable facts were identified for Chile, Paraguay, Bolivia, Colombia, or Uruguay in the material provided.

Technical indicators

The material does not include hashes, IPs, domains, or directly reusable full IOC filenames for the backdoor. It does, however, provide DLL and component names observed in the loading chain, which can serve as partial indicators in environments where they are not expected legitimately.