FamousSparrow Targets Latin American Governments

ESET linked FamousSparrow to activity against government entities in eight countries and territories in Latin America, with SparroWocky at the center. Telemetry cited by The Hacker News also suggests that nearly 90% of recorded targets between mid-2025 and 2026 were in the region, though that figure remains unconfirmed independently.

What did ESET reveal about SparroWocky?

ESET described SparroWocky as a modular C++ backdoor and said its architecture and techniques show advanced knowledge of Windows internals and anti-analysis mechanisms. Alexandre Côté Cyr and Romain Dumont were the firm’s researchers named in the report cited by The Hacker News.

The Hacker News also reported that early versions of SparroWocky included the first stanza of Jabberwocky, the poem that inspired the malware’s name. That detail adds to the technical identification of the implant, which ESET says is part of the operation attributed to FamousSparrow.

What operational capabilities are attributed to it?

Expediente Público reported that SparroWocky is believed to have functions for periodic screenshots, file exfiltration, remote command execution, and using the compromised machine as a bridge to other systems. The publication also described a screen-monitoring mode that can take an initial capture and then record changes every 500 milliseconds, although the available material does not confirm whether that figure comes directly from ESET’s technical notice or from a journalistic interpretation.

According to Expediente Público, those capabilities point to flexible use of the initial access, not only for surveillance but also for lateral movement inside the compromised environment. The published report does not provide independent validation of the screenshot frequency mentioned.

How far did the campaign spread in the region?

The Hacker News said ESET detected some overlap between FamousSparrow, Earth Estries, and Salt Typhoon, although the report does not specify whether the similarity involves infrastructure, tools, victims, or procedures. In parallel, the telemetry cited by that outlet indicates, without independent confirmation, that 90% of the recorded targets between mid-2025 and 2026 were in Latin America.

Taken together, those elements place the region at the center of the group’s attributed activity, but the available material does not spell out the full list of the eight countries and territories mentioned, nor does it separately confirm the scope of each attribution. The Standard CIO also published a note on the alert in Latin America, in line with that regional focus.