The China-aligned state-sponsored threat group known as FamousSparrow has been observed using a previously undocumented backdoor called SparroWocky in cyber espionage campaigns targeting organizations across Latin America.
Security researchers say the malware has been deployed against multiple countries in the region since at least August 2025, with government organizations among the identified targets.
SparroWocky is a modular backdoor written in C++. Researchers describe it as technically sophisticated, with several features designed to make analysis and detection more difficult.
New Backdoor Replaces SparrowDoor
FamousSparrow has been active since at least 2019 and has previously been associated with another backdoor known as SparrowDoor.
Recent research indicates that the group has increasingly replaced SparrowDoor with SparroWocky as its primary implant.
FamousSparrow has also been linked to activity overlapping with threat clusters known as Earth Estries and Salt Typhoon, although the exact relationships between these groups remain subject to ongoing analysis.
The name SparroWocky comes from early samples of the malware that contained the opening stanza of “Jabberwocky,” the well-known nonsense poem by English writer Lewis Carroll.
Extensive Remote Access Capabilities
SparroWocky provides attackers with a broad set of capabilities for controlling compromised systems and collecting information.
According to researchers, the backdoor can:
- Execute arbitrary files
- Run attacker-controlled commands
- Operate as a TCP proxy
- Collect information about the compromised computer
- Gather IP addresses associated with network interfaces
- Upload files to the attackers
- Take periodic screenshots
- Perform file-management operations
- Delete itself from an infected system
These capabilities allow the attackers to maintain remote access while collecting information from compromised environments.
Open-Source Components Integrated Into the Malware
One of the notable characteristics of SparroWocky is its use of components from several publicly available projects.
The malware incorporates Mbed TLS to establish encrypted communications with its command-and-control infrastructure.
Researchers identified a command-and-control address associated with the malware at:
216.238.110[.]120
SparroWocky also incorporates MinHook, which is used to conceal the starting addresses of newly created threads from security software.
Another component, COFF Loader, enables the malware to dynamically load and execute plugins directly in memory.
The backdoor also uses functionality derived from SilentMoonwalk, sometimes referred to as StackMoonwalk, to spoof call stacks associated with MinHook routines.
These techniques can make it more difficult for security products and analysts to identify the malware’s activity.
Attackers Continue Using DLL Sideloading
Although the malware family has changed, researchers observed that FamousSparrow continues to rely on techniques previously associated with its operations.
SparroWocky is launched through a DLL sideloading process.
In this technique, a legitimate executable is used to load a malicious DLL. The loader then decrypts and launches the primary malware payload.
The initial method used by attackers to gain access to targeted networks remains unknown.
The continued use of DLL sideloading demonstrates that the group has retained elements of its previous infection methodology while developing a new malware platform.
Latin America Becomes a Major Target
The most notable change in FamousSparrow’s recent activity is the apparent concentration of attacks against organizations in Latin America.
Researchers observed SparroWocky being used against government entities in:
- Argentina
- Ecuador
- Guatemala
- Honduras
- Panama
- Peru
- Puerto Rico
- Venezuela
According to telemetry collected by researchers, approximately 90% of the group’s identified targets were located in Latin America.
The increased focus appears to have begun around July 2025, although the exact reason for the geographic concentration remains unclear.
Researchers have not determined whether Latin America represents a formal targeting priority for the group or whether the current activity reflects temporary geopolitical circumstances.
FamousSparrow Expands Its Custom Malware Capabilities
The development of SparroWocky demonstrates that FamousSparrow is not simply relying on publicly available offensive security tools.
The group has previously used open-source utilities alongside its own malware. With SparroWocky, however, researchers observed several open-source components being directly integrated into a custom backdoor.
This approach gives the attackers greater control over how individual components operate within their malware and can make attribution and detection more challenging.
The combination of custom development, encrypted communications, in-memory execution, anti-analysis techniques, and DLL sideloading provides the group with multiple mechanisms for maintaining access to compromised systems.
What Organizations Should Watch For
Organizations in Latin America, particularly government entities and other high-value targets, should monitor for suspicious DLL sideloading activity and unexpected use of legitimate executables to load unsigned libraries.
Security teams should also investigate:
- Unusual encrypted outbound connections
- Unexpected TCP proxy activity
- Suspicious in-memory module execution
- Abnormal thread creation
- Unauthorized screenshots or file transfers
- Unexpected use of DLL loading mechanisms
- Connections to previously unidentified command-and-control infrastructure
The emergence of SparroWocky highlights the continuing evolution of FamousSparrow’s tooling.
While the group has shifted away from its older SparrowDoor backdoor, researchers say many of its underlying techniques remain consistent. Its increasing use of custom malware also indicates that the threat actor continues to invest in capabilities designed to maintain stealthy, long-term access to targeted organizations.
