SparrowDoor

The China-aligned state-sponsored threat actor FamousSparrow has been deploying a new modular C++ backdoor named SparroWocky in targeted cyber espionage attacks across Latin America since at least August 2025. The malware, which replaces the group's previous SparrowDoor implant, supports command execution, file exfiltration, periodic screenshots, and acts as a TCP proxy. It uses anti-analysis techniques and integrates open-source tools like Mbed TLS, MinHook, and COFF Loader for secure communications, evasion, and in-memory plugin execution. Targets include governmental entities in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela, with 90% of observed activity focused on the region.

The China-linked threat actor FamousSparrow has been conducting espionage campaigns against government organizations in Latin America since mid-2025, using a new modular C++ backdoor named SparroWocky. This malware replaces the group's previously used SparrowDoor backdoor and is deployed via DLL side-loading, with payloads RC4-encoded in .dat files. SparroWocky features advanced evasion techniques, including thread creation hooking to spoof legitimate Windows functions, in-memory code manipulation, and anti-analysis tricks, enabling command execution, file manipulation, screenshot capture, and proxy capabilities. The malware establishes persistence via a Windows service or registry key and communicates with C2 servers over ports 443 or 8080, sometimes through HTTP and SOCKS5 proxies.