cybersecurity•Thu, September 17, 2026•5 min read

SparroWocky: The Sophisticated New Backdoor Threatening Latin American Governments

The China-aligned hacking group FamousSparrow has deployed a sophisticated new modular backdoor dubbed SparroWocky. Targeting governmental organizations across Latin America, the malware represents a significant shift in the group's tactical operations.

A New Threat in Latin America

In a significant development for regional cybersecurity, researchers at ESET have identified a new, highly capable backdoor being leveraged by the China-aligned Advanced Persistent Threat (APT) group known as FamousSparrow. The malware, named SparroWocky, has been systematically deployed against governmental organizations in Latin America since at least August 2025.

FamousSparrow, active since at least 2019, was historically noted for targeting the hospitality industry. However, this shift toward government entities is viewed by analysts as a strategic reaction to the growing influence and interests of the United States within the Latin American region.

Inside SparroWocky: What Makes It Dangerous

SparroWocky is a modular C++ backdoor designed with deep knowledge of Windows internals. ESET's analysis highlights its ability to evade traditional security software through sophisticated techniques, including memory manipulation and runtime code patching.

Modular Architecture: The malware is built for flexibility, allowing the group to tailor its capabilities to specific targets.
Anti-Analysis Tricks: It employs complex techniques specifically designed to complicate reverse engineering and detection by security teams.
Open-Source Integration: Unlike its predecessors, SparroWocky incorporates open-source project code directly into its malicious framework, signaling an evolution in the group's development capabilities.
Memory Manipulation: The backdoor operates by patching code at the memory level to avoid triggering standard security alerts.

A Pattern of Escalation

This latest campaign follows a long history of espionage activity by FamousSparrow. Previous operations saw the group utilizing the SparrowDoor backdoor to breach engineering firms, law firms, and research institutes across multiple continents. The transition to SparroWocky represents a marked increase in the technical maturity of the threat actor.

Fortunately, while advanced, SparroWocky’s inner workings are much less arcane than a ‘gyre and gimble in the wabe,’ so a ‘through and through [of] the vorpal blade’ allowed us to bring you a detailed analysis.
— ESET Research

Key Takeaways

FamousSparrow has pivoted from targeting hospitality to state-level espionage.
The new SparroWocky backdoor has been active in Latin America since August 2025.
The malware utilizes advanced memory-level patching to evade detection.
FamousSparrow is increasingly integrating open-source offensive tools into their custom infrastructure.
The surge in targeting is believed to be a response to changing geopolitical dynamics between China and the U.S. in Latin America.

FAQ

What is SparroWocky?

SparroWocky is a new, modular C++ backdoor developed and used by the China-aligned threat group FamousSparrow.

Who are the primary targets of SparroWocky?

The malware is primarily being used to target governmental organizations within Latin American countries.

How does SparroWocky evade security software?

It uses advanced techniques such as manipulating low-level structures in memory and patching code at runtime to remain undetected.

Who is FamousSparrow?

FamousSparrow is an APT (Advanced Persistent Threat) group aligned with China that has been active since 2019, previously known for cyberespionage against global hotel chains and diverse industries.