China-linked FamousSparrow uses new SparroWocky backdoor in espionage attacks on Latin American governments

A China-linked hacking group has been spying on government organizations across Latin America with a new custom backdoor called SparroWocky. ESET says FamousSparrow has used the malware for more than a year against targets in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela, replacing its earlier SparrowDoor tool. The C++ malware is delivered via DLL side-loading, persists through a Windows service or registry key, and can run commands, move files, capture screenshots, proxy traffic, and hide its activity with anti-analysis and in-memory evasion techniques.

Why it matters: Government organizations in Latin America and any partners handling related communications should review indicators of compromise, hunt for DLL side-loading and unusual Windows services or registry persistence, and check for traffic to the reported command-and-control servers. The story matters because it shows a sustained state-linked intelligence campaign using a newly documented backdoor rather than a one-off intrusion.

Sources

China's Salt Typhoon backdoors Latin American orgs with new snooping malware

2026.09.17 98% relevant

This article is a direct report on the same ESET findings, adding context that the activity is attributed to Salt Typhoon/FamousSparrow, that 90 percent of the group’s targets from mid-2025 into 2026 were in Latin America, and that the SparroWocky backdoor was used against government entities across Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela.

China’s FamousSparrow hackers target Latin America with new backdoor

2026.09.17 99% relevant

This article is a direct report on the same ESET disclosure, adding country-level targeting details across Guatemala, Honduras, Puerto Rico, Panama, Venezuela, Peru, and Argentina, plus context on suspected Chinese interest in Latin American governments and Panama canal-related entities.

China-Aligned FamousSparrow Deploys SparroWocky Backdoor Across Latin America

info@thehackernews.com (The Hacker News) 2026.09.17 98% relevant

This appears to be the same underlying event: reporting on China-aligned FamousSparrow deploying the SparroWocky backdoor against government organizations in Latin America.

Chinese hackers use SparroWocky malware in govt espionage attacks

Bill Toulas 2026.09.17 100% relevant

This article appears to be the first tracked item here specifically about FamousSparrow's SparroWocky malware campaign targeting Latin American government organizations.