GoKawiilFamousSparrow deploys new SparroWocky backdoor against Latin American governments
ESET researchers report that the China-linked hacking group FamousSparrow has spent over a year running espionage campaigns against government agencies across Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela. The group's newly identified tool, a modular C++ backdoor called SparroWocky, replaces its older SparrowDoor malware and includes advanced anti-detection and remote-control capabilities.
GoKawiil's interpretation of the reporting above, not reported fact.
The targeting pattern suggests Beijing is closely monitoring how Latin American governments respond to U.S. economic pressure on Chinese interests, turning regional diplomacy into an intelligence-gathering target. SparroWocky's sophisticated evasion techniques—like spoofing call stacks and disguising itself as legitimate Windows processes—show state-linked actors continuing to invest heavily in stealth, making detection harder for government cybersecurity teams with limited resources.
- FamousSparrow's new SparroWocky backdoor has targeted governments in at least eight Latin American countries.
- The malware can execute commands, capture screenshots, manage files, and proxy network traffic while evading detection.
- The campaign appears aimed at tracking regional government reactions to U.S.-China economic tensions.
Source: bleepingcomputer.com, 2026-09-17
Published there as: “Chinese hackers use SparroWocky malware in govt espionage attacks”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.