Researchers at ESET have documented an extended espionage operation by the China-linked group FamousSparrow targeting government organizations across Latin America. The campaign, which has persisted for over a year, introduced a new backdoor called SparroWocky that supersedes the group's earlier SparrowDoor custom backdoor.
The malware has been observed in intrusions against government entities in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela. ESET's researchers assess that FamousSparrow's primary objective centers on gathering intelligence regarding how Latin American governments are responding to mounting U.S. economic pressure on Chinese interests.
Technical capabilities and architecture
SparroWocky is a modular C++ backdoor that incorporates code from publicly available open-source projects. The malware incorporates anti-analysis defenses, including techniques that manipulate memory structures at low levels and modify code during runtime execution.
The backdoor's functional capabilities encompass:
- Executing commands and running executable files
- Loading and running Beacon Object Files directly in memory
- Extracting system, network, user, domain, and Windows version information
- Scanning drives, directories, files, display configurations, and logged-in user sessions
- Performing file operations including upload, download, copy, move, rename, and deletion
- Capturing screenshots at 500-millisecond intervals, transmitting only the portions of the screen that have changed following the initial full capture
- Spawning processes within sessions of other authenticated users
- Functioning as a TCP proxy to relay network traffic
- Removing persistence mechanisms and erasing its own files from disk
Deployment and evasion techniques
The malware reaches target systems through DLL side-loading, where a loader first decrypts an RC4-encoded payload stored in a .dat file and directly maps it into memory to evade detection.
SparroWocky employs multiple evasion strategies to avoid detection by security tools. These include spoofing call stacks and threat origins, resolving APIs dynamically at runtime, and masquerading malicious in-memory code and DLLs as legitimate Windows system components.
A particularly sophisticated evasion method involves intercepting the Windows thread creation process to alter the starting address of threads. According to ESET, "SparroWocky uses the MinHook library to hook the CreateThread function in order to conceal the original lpStartAddress parameter from security products. Essentially, any thread created by SparroWocky would have AnimateWindow as the starting address, which would likely be considered legitimate by a security product."
The malware establishes persistence on compromised systems through either a Windows service named ProcAuditManager or by creating a Windows registry key called SnapCart under HKLM or HKCU, with the choice depending on the privilege level available to the malware.
Attribution and infrastructure
The sophistication of SparroWocky's architecture and evasion methods point to a well-funded and highly experienced threat actor. ESET notes that the malware demonstrates "strong knowledge of anti-analysis tricks and Windows internals," characteristics consistent with FamousSparrow's established capabilities.
During their investigation, ESET identified at least 18 command-and-control addresses used to communicate with the malware. These servers receive traffic either directly over port 443 or 8080, or through intermediary HTTP and SOCKS5 proxies.
Telemetry data from ESET indicates that beginning in mid-2025, FamousSparrow has concentrated its targeting efforts predominantly on entities within the Latin America region. The company's published report provides detailed technical analysis of the SparroWocky backdoor and includes a comprehensive list of indicators of compromise tied to this campaign.