GoKawiilA Chinese cyber-espionage group known as "FamousSparrow" is using a revamped backdoor to build a nest inside Central and South American governments and major industries.
The advanced persistent threat (APT) is associated with, but not definitively confirmed to be related to, Earth Estries and Salt Typhoon; it's a seven-year-old outfit that made its reputation by attacking international hotels, and governments and corporations here and there. It appears to have changed its modus operandi of late, though, to become China's eyes and ears in the global southwest. Since the summer of 2025, it has been using a custom backdoor called "SparroWocky" to keep an eye on government agencies in the Latin American region, particularly those that host Chinese investments that are currently being scrutinized by the Trump administration.
Chinese Cyberattacks in Latin America
In July 2025, ESET researchers observed FamousSparrow pivot to exclusively targeting government organizations in Latin America. To meet its new challenge, the following month, it ditched its namesake "SparrowDoor" backdoor for the aforementioned SparroWocky malware.
Related:Cyber Op Targets South Korean Media & Automotive Sectors
APTs commonly iterate on their flagship spying tools, developing newer and more powerful versions as their ambitions grow, or their targets wise up. FamousSparrow took the harder route with SparroWocky, utilizing some of the same logic as its past malware, but largely building something new from the ground up. Alexandre Côté Cyr, malware researcher at ESET, speculates that SparrowDoor was aging, widely cloned, and possibly triggering cybersecurity alerts too readily.
"For a time, we thought it was exclusive to them, but over the last couple of years we've seen versions of the same thing — [malware that] seems to have a common ancestor, used by other threat groups. So one possibility is that because this malware is now widespread, it's better detected," he says.
The threat actors' new toy is a modular C++ program, deployed via dynamic link library (DLL) sideloading. To fly under the radar, FamousSparrow executes its malware in-memory, encrypts its command-and-control (C2) traffic, and automates self-deletion. It also stacks on a couple of neat tricks.
"Stack spoofing is pretty awesome," says ESET senior malware researcher Romain Dumont. "The fact that they used it proved that they were really willing to avoid being detected." Stack spoofing is the process of messing with a thread's call stack, such that potentially sensitive function calls made by a malicious program could be made to seem like they came from a legitimate program.
Related:Old, Unpatched Flaws Give Attackers Access to Philippines Nuclear Agency
... continue reading