The China-linked espionage group FamousSparrow has deployed the FamousSparrow SparroWocky backdoor across government organisations in Latin America, with researchers at ESET now publishing a detailed technical breakdown of the malware and its accompanying infrastructure. The campaign has been running for more than a year, and it marks a meaningful evolution in the group’s tooling.
According to ESET researchers, SparroWocky is a modular, full-blown C++ backdoor that has, since August 2025, effectively replaced the group’s previous custom implant, SparrowDoor. Yahoo Finance’s coverage of the ESET research notes that FamousSparrow appears to have abandoned SparrowDoor entirely in favour of the new tool, and that the cyberespionage trend against high-profile targets in the region started no later than July 2025.
FamousSparrow SparroWocky Backdoor: What It Does
SparroWocky is built to do a lot. Its capability list covers running commands and executable files, loading and executing Beacon Object Files in memory, and collecting system, network, user, domain, and Windows-version details. On the file side, it can enumerate drives, directories and active user sessions, and handle the full range of file operations: upload, download, copy, move, rename and delete.
The surveillance angle is handled through continuous screen capture: the malware grabs screenshots every 500 milliseconds, but transmits only changed regions after the first full-screen image, keeping outbound traffic relatively lean. It can also create processes in another logged-in user’s session, operate as a TCP proxy and forward connections, and, when the operator is done, remove its own persistence and delete its files.
Persistence is established either via a Windows service named ProcAuditManager or through a Windows registry key called SnapCart, placed under HKLM or HKCU depending on what privileges the malware has obtained. The choice of mechanism is automatic, driven by access level rather than operator input.
Delivery relies on DLL side-loading. A loader decrypts an RC4-encoded payload stored in a .dat file and maps it directly into memory, avoiding the kind of disk writes that endpoint tools tend to catch. From there, evasion layers stack up: call stack and thread origin spoofing, dynamic API resolving, and disguising malicious in-memory code and DLLs as legitimate Windows components.
The hooking behaviour is worth dwelling on. ESET explains that SparroWocky uses the MinHook library to hook the CreateThread function, specifically to conceal the original lpStartAddress parameter from security products. ‘Essentially, any thread created by SparroWocky would have AnimateWindow as the starting address, which would likely be considered legitimate by a security product,’ ESET writes. It is a tidy trick: intercept thread creation, swap in a benign-looking start address, and let the security layer wave it through.
A Sharp Regional Focus and Wider Threat Landscape Connections
The targets ESET observed span Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela. The researchers assess that the group’s objective was intelligence collection on Latin American governments’ responses to increasing US pressure on Chinese economic interests.
The regional concentration is now pronounced. From mid-2025 into 2026, 90% of the group’s targets registered in ESET telemetry have been located in Latin America, according to Yahoo Finance’s reporting on the ESET research. That is a deliberate narrowing of focus, not a broadening campaign.
ESET also identified at least 18 command-and-control (C2) addresses communicating with SparroWocky, either directly over port 443 or 8080, or through HTTP and SOCKS5 proxies. The C2 infrastructure gives the operation considerable flexibility in routing traffic and complicates network-level detection.
The group does not operate in isolation. The Hacker News reports that FamousSparrow shares some level of overlap with Earth Estries and Salt Typhoon, two other China-aligned threat actors that have attracted considerable attention from Western security researchers and governments in recent years. The nature and extent of that overlap is not specified further, but the connection places FamousSparrow within a broader ecosystem of well-resourced intrusion activity.
ESET’s researchers characterise SparroWocky’s architecture and evasion techniques as indicating ‘strong knowledge of anti-analysis tricks and Windows internals’, consistent with attribution to an experienced, well-resourced threat group. The company’s published report includes the full technical analysis along with a list of indicators of compromise (IoCs) for defenders wanting to check their environments against the known activity.
