Chinese Group FamousSparrow Targets Latin American Governments with the SparroWocky Backdoor

The China-linked espionage group FamousSparrow has spent more than a year using a new backdoor, SparroWocky, in attacks on government organizations across Latin America. According to ESET researchers, the new tool has replaced the group's previous custom backdoor, SparrowDoor.

The attacks have been recorded against organizations in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico and Venezuela. Analysts believe the attackers' goal is to gather intelligence on how the region's governments are responding to mounting U.S. pressure on Chinese economic interests. Since mid-2025, Latin America has become the group's primary focus.

What SparroWocky Can Do

SparroWocky is a full-fledged modular backdoor written in C++ that incorporates code from open-source projects. It can run commands and executables, load Beacon Object Files into memory, collect information about the system, network, users and domain, enumerate drives, directories, displays and active sessions, and take full control of files — uploading, copying, renaming and deleting them.

One feature deserves special attention: its surveillance capability. The backdoor takes screenshots every 500 milliseconds, but after the first full frame it transmits only the parts of the screen that have changed — economical and stealthy. On top of that, it can create processes in the sessions of other logged-in users, act as a TCP proxy and, when needed, wipe itself without a trace along with its persistence mechanisms.

A Bet on Camouflage

The malware's authors are clearly well acquainted with the inner workings of Windows. The loader decrypts an RC4-encrypted payload from a .dat file and maps it directly into memory, while the backdoor itself is delivered via DLL side-loading. Its arsenal includes call stack and thread origin spoofing, dynamic API resolution, and disguising malicious code as legitimate Windows components.

Particularly elegant is its trick against security solutions: using the MinHook library, the program hooks the CreateThread function and swaps the thread's real start address for AnimateWindow — a perfectly harmless system function that raises no suspicion. Persistence is achieved through a Windows service (ProcAuditManager) or a registry key (SnapCart), depending on the privileges available.

According to ESET, the architecture and evasion techniques point to a “deep knowledge of anti-analysis tricks and the internals of Windows,” which is consistent with attribution to an experienced and well-resourced group. During the investigation, analysts identified at least 18 command-and-control server addresses that communicated with the malware over ports 443 and 8080 or through HTTP and SOCKS5 proxies. A full technical breakdown and a list of indicators of compromise have been published in the company's report.

Source: Bleeping Computer