FamousSparrow deploys new SparroWocky backdoor across Latin America
FamousSparrow, a China-aligned advanced persistent threat group tracked by ESET Research since 2021, has developed and deployed a new custom backdoor named SparroWocky against governmental organisations across Latin America. ESET says the campaign began no later than July 2025, with the new backdoor variant appearing from August 2025 onwards. In that period, 90% of the group's targets registered in ESET telemetry have been located in the region, an unusually concentrated geographic footprint for a group that has historically operated across multiple continents.
ESET researcher Alexandre Côté Cyr, who led the investigation, confirmed that the new backdoor has been deployed against governmental entities in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela. The naming of the backdoor reflects a detail in the malware itself: the first samples collected each contained the opening stanza of Lewis Carroll's nonsense poem "Jabberwocky" embedded within the code.
How SparroWocky works
SparroWocky is a modular C++ backdoor with capabilities that include launching arbitrary files, acting as a TCP proxy, executing commands, periodic screenshot capture, and file exfiltration. Collected data, including machine name, username, domain name, Windows version, and network interface IP addresses, is encrypted using RC4 and transmitted over TLS. The backdoor establishes persistence either via a dedicated Windows service or a registry Run key entry, depending on its configuration.
The malware employs runtime code patching and manipulation of low-level memory structures to hinder analysis and evade security tools. Notably, SparroWocky can load and execute Beacon Object Files, a format associated with commercial red-teaming frameworks. ESET says this marks a development step for FamousSparrow: where the group previously deployed open-source offensive tooling alongside its proprietary backdoors, SparroWocky integrates open-source code directly into the custom implant itself.
ESET attributes the campaign to FamousSparrow with high confidence. In early attacks, SparroWocky was deployed by SparrowDoor, a backdoor used exclusively by FamousSparrow. The victimology also overlaps with prior SparrowDoor deployments at the same organisations, reinforcing attribution.
Geopolitical context and threat landscape
ESET frames the geographic concentration as deliberate and geopolitically motivated. The firm assesses that FamousSparrow's intensified focus on Latin American government targets likely reflects China's effort to monitor regional reactions to renewed US pressure in the continent under President Trump's second term. Chinese state investments in Latin American energy, mining, and telecommunications infrastructure have come under increasing scrutiny as Washington reasserts strategic interests in the region.
One target identified by ESET is a Panamanian entity directly involved in the commercial dispute over two major ports in the Panama Canal area, previously operated by a Chinese company. That specific target selection supports the hypothesis that the campaign is oriented toward intelligence collection on geopolitical flashpoints rather than financial or criminal objectives.
FamousSparrow is assessed to have been active since at least 2019 and was first publicly documented by ESET in September 2021 following exploitation of the ProxyLogon vulnerability in Microsoft Exchange. The group has since broadened its targeting from hotels to governments, international organisations, trade bodies, engineering firms, and law firms.
The campaign sits within a broader pattern of China-aligned APT activity against Latin American institutions that security researchers have noted as escalating since 2024. Defenders in the region, many of whom operate with constrained security budgets and limited threat intelligence sharing, face an adversary with demonstrated capability to develop novel tooling and sustain long-running intrusions. ESET has published a full technical analysis of SparroWocky on its WeLiveSecurity blog.