The pro-Chinese APT group focuses its cyberespionage activities on Latin American government organizations. Since August 2025 it has been using SparroWocky, a new backdoor developed in C++ that directly incorporates code from open source projects
ESET Research, as part of its FamousSparrow monitoring activities, has detected SparroWocky, a new malware developed by the China-linked cyberespionage group and distributed since at least August 2025 against organizations in several Latin American countries. As a likely response to the growing US interest in that land area, FamousSparrow has intensified targeted attack activities against various government institutions. ESET researchers chose the name SparroWocky because the first variants of the malware identified all contained the first stanza of “Jabberwocky”, the famous nonsense poem by the English writer, poet and mathematician Lewis Carroll, contained in the novel “Through the Looking-Glass and What Alice Found There” (published in 1871 as a sequel to “Alice in Wonderland”).
«Fortunately, despite being sophisticated, the functioning of SparroWocky did not prove to be an indecipherable black box. We managed to open it, reconstruct its functioning and analyze the mechanisms of the backdoor in detail – explains Alexandre Côté Cyr, ESET researcher -. The expert came to this discovery during the investigations conducted on the pro-Chinese hacker collective.
SparroWocky is a malware developed in C++. Its architecture and the techniques adopted by the authors highlight in-depth knowledge of the internal mechanisms of Windows and anti-scanning techniques. Furthermore, in the transition from SparrowDoor to SparroWocky, FamousSparrow began integrating code from open source projects directly into its malware. This cyberespionage activity against high-profile targets in Latin America was detected as early as July 2025 and continued with the subsequent introduction of SparroWocky. The growing concentration of FamousSparrow's operations in the region also emerges from ESET telemetry: from mid-2025 and throughout 2026, 90% of the group's targets detected by ESET were in fact located in Latin America.
«We have observed the use of the new malware against government entities in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico and Venezuela – says Côté Cyr of ESET -. Such a prolonged geographical concentration represents a rare case among the pro-China APT groups monitored by ESET, whose activities are generally detected in different regions of the world."
ESET's opinion is that this exclusive focus is not accidental and is attributable to the Dragon's reaction to recent US initiatives in the region. The second term of US President Donald Trump, in fact, has led to a decisive reaffirmation of American interests in Latin America, which threatens several long-term investments across the continent developed by Beijing over the last decade in sectors such as energy, mining and telecommunications. FamousSparrow's activities would likely be aimed at helping China better monitor and anticipate local governments' reactions to current US pressure. In some cases, specific elements seem to clearly confirm this hypothesis. For example, one of the targeted Panamanian entities is directly involved in the current trade dispute surrounding two major ports located in the Panama Canal Area, which until recently were operated by a China-based company.
SparroWocky's main features include the ability to launch arbitrary files, operate as a TCP proxy, and execute commands. The backdoor also collects information about the compromised system, including the computer name, username, domain, Windows version, and IP addresses associated with network interfaces. SparroWocky can also exfiltrate files and periodically take screenshots. The exfiltrated data is encrypted via RC4 and transmitted via the TLS protocol. Depending on the configuration, the backdoor can maintain persistence on the compromised system by creating a dedicated service or an entry in the Run key in the Windows Registry.
Il nuovo malware utilizza diverse tecniche per ostacolare l’analisi ed eludere i software di sicurezza eventualmente presenti sul sistema. Per evitare il rilevamento, SparroWocky manipola strutture interne in-memory e modifica il codice durante l’esecuzione. Inoltre, FamousSparrow continua a utilizzare strumenti offensivi open source per scopi malevoli. In precedenza, questi tool venivano impiegati principalmente insieme alla backdoor del gruppo. Con SparroWocky, i ricercatori ESET hanno invece rilevato che FamousSparrow dispone delle capacità di sviluppo necessarie per integrare codice open source direttamente nella propria backdoor sviluppata ad hoc. Inoltre, SparroWocky è in grado di caricare ed eseguire Beacon Object File (BOF), una particolare tipologia di file eseguibile supportata da numerosi strumenti di red teaming e penetration testing.
FamousSparrow has been active since at least 2019: ESET Research first publicly documented its activities in a September 2021 blog post, when the group exploited the ProxyLogon vulnerability. Initially known for targeting hotels around the world, the group later also attacked governments, international organizations, trade associations, engineering firms and law firms.
ESET attributes both the latest campaign and the SparroWocky backdoor to FamousSparrow with a high degree of certainty. In fact, in some of the first attacks in which it was used, SparroWocky was distributed through SparrowDoor, a backdoor used exclusively by FamousSparrow. The victim profile is also consistent with the group's previous targets: ESET has also detected attempts to distribute SparroWocky at many of the same organizations previously targeted with SparrowDoor. FamousSparrow is the only group known to use the SparrowDoor backdoor.
