INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

FamousSparrow Deploys SparroWocky Backdoor

| 2026-09-17 11:55 CRITICAL HIGH MALWARE & BOTNETS
JSON
Executive Summary
AI-generated
FamousSparrow, a China-aligned group, has been targeting governments across Latin America since at least August 2025. The attack affected eight countries in the region: Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela. FamousSparrow gained access by exploiting publicly reachable Exchange servers and deployed its new SparroWocky backdoor, which is a separate family from SparrowDoor but shares some functions. The modular C++ backdoor can run commands, execute files, act as a TCP proxy, collect host and network details, exfiltrate files, and take screenshots on a repeating cycle. Exfiltrated data is encrypted with RC4 and sent over TLS. FamousSparrow's focus on Latin America appears to be China's likely reaction to renewed US interest in the region under Donald Trump's second term, which could threaten Chinese investments built up over a decade in energy, mining, and telecommunications.
Technical Mitigations AI-generated
• Patch Exchange servers to prevent exploitation by FamousSparrow. • Monitor for the SparroWocky backdoor, which can run commands and execute files using a modular C++ framework. • Detect and block Beacon Object Files (BOF) loaded by SparroWocky, as they are used in Cobalt Strike red-teaming frameworks.
Technical Observables Login Required
Indicators of Compromise (IoCs) Protected

Raw threat telemetry, malicious IP addresses, file hashes, and direct VirusTotal correlation are restricted to authenticated users.

Sign In to View 4 IoCs Create Free Account
44f0a2••••••••••••••••••••••••••••••••••
52c664••••••••••••••••••••••••••••••••••
320968••••••••••••••••••••••••••••••••••
9aa9ff••••••••••••••••••••••••••••••••••
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Salt TyphoonSalt Typhoon Cobalt StrikeCobalt Strike
Target & Sectors
NORTH_AMERICA NORTH_AMERICA LATAM LATAM governmentgovernment
Incident Timeline
‎at least August 2025
FamousSparrow has been deploying the SparroWocky backdoor against governments across Latin America since at least August 2025.
target_region LATAM
The threat actor known as FamousSparrow has replaced its long-running SparrowDoor implant with a new backdoor called SparroWocky, and has been deploying it against governments across Latin America since at least August 2025.
organisation FamousSparrow
The threat actor known as FamousSparrow has replaced its long-running SparrowDoor implant with a new backdoor called SparroWocky, and has been deploying it against governments across Latin America since at least August 2025.
organisation SparrowDoor
The threat actor known as FamousSparrow has replaced its long-running SparrowDoor implant with a new backdoor called SparroWocky, and has been deploying it against governments across Latin America since at least August 2025.
organisation SparroWocky
The threat actor known as FamousSparrow has replaced its long-running SparrowDoor implant with a new backdoor called SparroWocky, and has been deploying it against governments across Latin America since at least August 2025.
‎early 2025
ESET, a Panamanian entity directly involved in the dispute over two major ports in Panama's canal area, was targeted by threat actors who exploited public-facing exchange servers to deploy SparroWocky backdoor.
target_region China
A Panamanian entity ESET saw targeted is directly involved in the dispute over two major ports in the canal area, run until recently by a China-based company whose concession the Panamanian government challenged in early 2025.
target_region Panama
A Panamanian entity ESET saw targeted is directly involved in the dispute over two major ports in the canal area, run until recently by a China-based company whose concession the Panamanian government challenged in early 2025.
industry Government
A Panamanian entity ESET saw targeted is directly involved in the dispute over two major ports in the canal area, run until recently by a China-based company whose concession the Panamanian government challenged in early 2025.
‎mid-2025
Threat actors associated with the group behind SparroWocky deployed a backdoor on approximately 90% of their targets in ESET telemetry between mid-2025 and early 2026.
organisation ESET
From mid-2025 into 2026, 90% of the group's targets in ESET telemetry sat in the region.
general_metric 90 %
From mid-2025 into 2026, 90% of the group's targets in ESET telemetry sat in the region.
‎2026/09/17
FamousSparrow, a China-aligned group with high confidence attributed by ESET Research, exploits public-facing Exchange servers to deploy the SparroWocky backdoor.
organisation ESET Research
ESET Research attributed the campaign to the China-aligned group with high confidence, partly because some of the earliest SparroWocky infections were delivered by SparrowDoor, which only FamousSparrow is known to use.
organisation Beacon Object Files (BOF
It also loads and executes Beacon Object Files (BOF), a format introduced in Cobalt Strike and since adopted by other red-teaming frameworks.
infrastructure Windows
SparroWocky patches code at runtime, forges call stacks so Windows API calls appear to come from legitimate thread entry points, and hooks thread creation so its own threads report a harmless start address.
organisation FamousSparrow Swaps SparrowDoor
FamousSparrow Swaps SparrowDoor For New SparroWocky Backdoor.
organisation TCP
The modular C++ backdoor can run commands, execute files, act as a TCP proxy, collect host and network details, exfiltrate files and take screenshots on a repeating cycle.
organisation TLS
Exfiltrated data is encrypted with RC4 and sent over TLS.
organisation ProxyLogon
The group has been active since at least 2019 and was first documented in 2021 exploiting ProxyLogon .
organisation Trend Micro
Trend Micro has linked it to Earth Estries , though ESET said that link is not fully understood, and it tracks FamousSparrow separately from Salt Typhoon for want of technical indicators.
organisation Earth Estries
Trend Micro has linked it to Earth Estries , though ESET said that link is not fully understood, and it tracks FamousSparrow separately from Salt Typhoon for want of technical indicators.
threat_actor Salt Typhoon
Trend Micro has linked it to Earth Estries , though ESET said that link is not fully understood, and it tracks FamousSparrow separately from Salt Typhoon for want of technical indicators.
Tactical Metrics
Metrics
infrastructure
‎Windows
Affected Product
SparroWocky patches code at runtime, forges call stacks so Windows API calls appear to come from legitimate thread entry points, and hooks thread creation so its own threads report a harmless start address.
Intelligence Sources
Infosecurity-Magazine 2026-09-17
AlienVault OTX 2026-09-17