Sparrowdoor - GoKawiil

Chinese APT FamousSparrow deploys new SparroWocky backdoor against Latin American governments

ESET researchers report that the Chinese-linked espionage group FamousSparrow shifted in mid-2025 to focus exclusively on government targets in Central and South America, replacing its older SparrowDoor malware with a newly built implant called SparroWocky. The group, loosely tied to Earth Estries and Salt Typhoon, appears to be zeroing in on agencies overseeing Chinese investments now under scrutiny from the Trump administration.

darkreading.com · 2026-09-17

FamousSparrow deploys new SparroWocky backdoor against Latin American governments

ESET researchers report that the China-linked hacking group FamousSparrow has spent over a year running espionage campaigns against government agencies across Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela. The group's newly identified tool, a modular C++ backdoor called SparroWocky, replaces its older SparrowDoor malware and includes advanced anti-detection and remote-control capabilities.

bleepingcomputer.com · 2026-09-17