ESET detects FamousSparrow activity in South America

ESET said the China-aligned group FamousSparrow remained active in South America between April and September 2026, continuing a pattern the company had already seen in the prior period. The official report does not identify specific victims or provide a complete list of campaigns in the region.

What scope does ESET's report cover?

The document should not be read as a full record of APT activity in South America. ESET says it is a selection of activity investigated by its own researchers, and that the report represents only part of the APT intelligence available to its customers.

That means the published material is enough to confirm FamousSparrow's persistence in the region, but not enough to turn that monitoring into a full inventory of targets, cases, or affected sectors. The source itself urges caution in how the scope is interpreted.

What is known about FamousSparrow in Latin America?

The information confirmed by ESET is enough to show that the group stayed active in South America during the period reviewed. Secondary coverage adds that FamousSparrow may have deployed the SparroWocky backdoor in several Latin American countries since at least August 2025, but that detail should be treated as secondary attribution.

That summary does not name countries, affected organizations, or provide independent confirmation. It therefore does not allow for specific victim identification, or for extending the available evidence to banking, energy, or other specific sectors. The available report is limited to the continuity of the activity observed and the caution required in reading it.