FamousSparrow Deploys SparroWocky Backdoor in Seven Latin American Governments Since August 2025
FamousSparrow narrowed its focus to Latin America with a new anti-analysis backdoor timed to U.S. pressure on Chinese regional investments. Evidence shows deliberate targeting of canal-port and trade entities rather than the group’s prior scattershot approach. The campaign supplies Beijing with advance notice of local reactions but lacks public technical attribution tying it to Salt Typhoon infrastructure.
The campaign marks a geographic narrowing for the group previously observed across hotels, trade bodies and international organizations since 2019. SparroWocky reuses open-source Windows internals code to evade analysis, exfiltrate files, capture screenshots and harvest host identifiers. One Panama victim directly manages canal-zone port concessions now under U.S. pressure.
Technical indicators align with prior FamousSparrow tooling while adding anti-analysis layers not seen in earlier Salt Typhoon-linked operations. The single-region focus contradicts the multi-continent pattern documented in ESET’s own historical reporting on the actor, suggesting tasking tied to specific Belt and Road friction points rather than broad intelligence collection.
U.S. statements link Salt Typhoon to Treasury and telecom intrusions; independent telemetry has not yet confirmed the same infrastructure overlap here. The timing coincides with renewed U.S. scrutiny of Chinese port operators, indicating the operation functions as an early-warning sensor for Beijing on local government responses.
Next indicators to watch are new SparroWocky samples on additional Panama canal entities or lateral movement into Peruvian and Argentine trade-ministry networks within the next 120 days.
ESET: Two additional Panama canal-zone entities show SparroWocky beacons by 31 March 2026
Sources (3)
- [1]Primary Source(https://therecord.media/china-hackers-latin-america-espionage)
- [2]Supporting Source(https://www.welivesecurity.com/2025/10/eset-famosus-sparrowocky-report)
- [3]Supporting Source(https://www.cisa.gov/news/2024/09/25/salt-typhoon-targeting-us-critical-infrastructure)