Verticals Targeted: Health, Government, Telecommunications, Justice, Maritime Transportation
Regions Targeted: Guatemala, Honduras, Puerto Rico, Panama, Venezuela, Ecuador, Peru, Argentina
Related Threat Actors: FamousSparrow
Related Families: SparroWocky
Executive Summary
China-aligned advanced persistent threat (APT) group FamousSparrow has shifted much of its targeting toward government organizations in Latin America while deploying a newly developed modular C++ backdoor called SparroWocky. ESET researchers observed the malware beginning in August 2025 and assess that it has rapidly replaced the group's previously established SparrowDoor backdoor, introducing advanced defense-evasion techniques, in-memory execution, Beacon Object File (BOF) support, command execution, proxy functionality, file exfiltration, and screenshot capture. Organizations should prioritize monitoring for anomalous DLL side-loading, suspicious persistence through Windows services and Run keys, unusual in-memory execution, and network connections associated with FamousSparrow infrastructure, particularly in environments handling government, diplomatic, trade, or other strategically valuable information.
Key Takeaways
- FamousSparrow has shifted heavily toward Latin America, with approximately 90% of targets observed in ESET telemetry from mid-2025 into 2026 located in the region, primarily involving government organizations.
- SparroWocky has replaced SparrowDoor as the group's primary backdoor, providing command execution, file transfer and exfiltration, screenshot capture, TCP proxying, and extensive system reconnaissance capabilities.
- The malware incorporates sophisticated defense-evasion techniques, including DLL side-loading, reflective in-memory PE loading, stack spoofing, API hooking, and manipulation of Windows loader structures to conceal malicious activity.
- Built-in Beacon Object File (BOF) support makes SparroWocky highly extensible, allowing FamousSparrow operators to dynamically load additional in-memory capabilities while increasingly integrating open-source offensive tooling directly into their custom malware.
Background
ESET Research identified a significant evolution in the tooling and targeting of FamousSparrow, a China-aligned cyberespionage group active since at least 2019. Beginning around July 2025, FamousSparrow shifted heavily toward Latin America. Approximately 90% of the group's targets observed in ESET telemetry from mid-2025 into 2026 were located in the region. Government entities in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela were among the organizations targeted.
Accompanying this geographic shift is a major change in FamousSparrow's malware ecosystem. Since at least August 2025, the threat actor has deployed SparroWocky, a new custom backdoor that rapidly replaced SparrowDoor as the group's primary implant. ESET emphasizes that SparroWocky is not simply another SparrowDoor version. It represents a separate malware family with a new architecture and significantly expanded integration of open-source offensive-security components. ESET assesses the campaign and malware as FamousSparrow activity with high confidence.
SparroWocky Technical Analysis
SparroWocky is a modular C++ backdoor designed around stealth, extensibility, and remote access. Its core capabilities allow an operator to execute arbitrary commands and files, transfer and exfiltrate data, enumerate the compromised environment, operate TCP proxies, manipulate files and directories, and capture screenshots. The malware collects extensive host information, including the computer and user names, domain, Windows version, network-interface IP addresses, malware process ID, executable location, and other configuration information. It can also enumerate logical drives, directories, remote user sessions, and display devices.
For data collection, SparroWocky supports file retrieval and periodic screenshot capture. Its screenshot functionality is particularly notable. After transmitting an initial JPEG image, the malware can repeatedly capture the display and transmit only blocks of pixels that changed from the previous screenshot, reducing the amount of data required for continued visual surveillance. Exfiltrated information is encrypted using RC4 and transmitted through TLS-protected communications.
Deployment and Persistence
FamousSparrow deploys SparroWocky through a trident loader consisting of three components:
- A legitimate executable
- A malicious DLL
- An encrypted payload file
Execution occurs through DLL side-loading, allowing a legitimate executable to load the malicious library. In observed samples, FamousSparrow modified otherwise legitimate DLLs by replacing part of their executable code, while retaining much of the original file's metadata and export structure. This allows the malicious component to more closely resemble the legitimate DLL and can complicate automated analysis. The loader decrypts the SparroWocky payload from an accompanying .dat file. The resulting PE payload has its normal MZand PE signatures removed and is reflectively mapped directly into memory rather than written to disk, potentially reducing detection by tools relying on conventional PE signatures or disk artifacts. SparroWocky supports two persistence mechanisms depending on its configuration: creation of a Windows service or creation of a value under the Windows Registry Run key. ESET observed configurations using a service named ProcAuditManager and a Registry persistence value named SnapCart.
Beacon Object File Support
One of SparroWocky's most significant capabilities is its ability to execute Beacon Object Files (BOFs) directly in memory. BOFs are position-independent Common Object File Format (COFF) objects designed to execute within the memory of an implant. Originally introduced through Cobalt Strike, BOF support has subsequently been adopted by other offensive-security and red-team frameworks. SparroWocky incorporates code derived from the open-source COFF Loader project to load these modules and execute specified functions.
This provides FamousSparrow with an extensible post-compromise framework. Operators can introduce additional functionality without rebuilding or replacing the primary backdoor. ESET also found that SparroWocky modifies the normal BOF-loading process so calls to external libraries are routed through its stack-spoofing mechanism, helping conceal activity performed by loaded modules. The capability represents an important development in FamousSparrow's use of publicly available offensive tooling. Earlier campaigns frequently deployed open-source tools alongside SparrowDoor. SparroWocky, instead, incorporates portions of these projects directly into the malware itself.
Advanced Defense Evasion
Some of SparroWocky's most distinctive technical characteristics are its anti-analysis and defense-evasion mechanisms. The malware implements a variation of SilentMoonwalk, also known as StackMoonwalk, to construct fake call stacks when executing monitored Windows API functions. By manipulating the apparent call chain, SparroWocky attempts to make suspicious API activity appear to originate from legitimate Windows functions rather than the malware itself. SparroWocky also incorporates the open-source MinHook library and hooks CreateThread to obscure the actual starting address of newly created threads. Threads created by the malware can consequently appear to originate from the legitimate Windows AnimateWindow API, which then acts as a trampoline to the real execution address.
Its custom PE loader performs additional host-process camouflage. When loading executable code into memory, SparroWocky can construct fake Windows loader structures and insert them into the Process Environment Block's module tracking structures. The technique attempts to make reflectively loaded executables appear more consistent with modules loaded normally by Windows and demonstrates substantial knowledge of Windows internals.
Command-and-Control (C2)
SparroWocky communicates with C2 infrastructure using TLS and incorporates the Mbed TLS library directly into the malware. The malware supports direct connections as well as connections through system-configured, HTTP, and SOCKS5 proxies. HTTP proxy authentication can use Negotiate authentication through Kerberos or NTLM or Basic authentication, while SOCKS5 connections can operate either with or without credentials. ESET observed SparroWocky C2 servers primarily using TCP port 443, although port 8080 has also been observed. Researchers noted some reuse of self-signed certificates but reported that they had not identified a sufficiently reliable generic certificate fingerprint for broad detection.
The backdoor's command set gives operators extensive control over compromised systems, including command execution, file manipulation and transfer, directory enumeration, TCP forwarding, screenshot capture, session enumeration, execution under another user's session, BOF execution, and execution of PE files directly in memory.
Who is FamousSparrow?
FamousSparrow is a China-aligned cyberespionage group believed to have operated since at least 2019. ESET first publicly documented the group in 2021 after observing it exploiting Microsoft Exchange servers through the ProxyLogon vulnerability. Although FamousSparrow initially attracted attention for targeting hotels worldwide, the group has also targeted governments, international organizations, trade groups, engineering companies, and law firms. More recent ESET investigations have additionally identified victims including a US financial-sector trade organization and a research institute in Mexico.
The group's signature malware historically has been SparrowDoor, a custom backdoor for which FamousSparrow remains the only known user. After relatively little public reporting between 2022 and 2024 led to speculation that the group had become inactive, ESET identified renewed FamousSparrow activity and two previously undocumented SparrowDoor versions, demonstrating that the actor had continued developing its malware.
Attribution becomes more complicated when FamousSparrow is compared with other China-aligned activity clusters. Trend Micro has linked FamousSparrow with Earth Estries, and ESET has identified overlaps between SparrowDoor and Earth Estries-associated tooling. However, ESET assesses that the exact nature of the relationship remains unclear and continues to track FamousSparrow as a distinct activity cluster. FamousSparrow has also been publicly associated with Salt Typhoon, but ESET cautions that available technical evidence is insufficient to establish that the clusters are synonymous. ESET therefore continues to track them separately, noting that observed overlaps between China-aligned clusters can potentially result from shared infrastructure, tooling, or third-party providers rather than demonstrating that two tracked groups represent the same underlying operator. The emergence of SparroWocky provides further evidence that FamousSparrow remains an active and technically capable espionage operation rather than a dormant legacy actor.
Analyst Commentary
FamousSparrow's transition from SparrowDoor to SparroWocky is notable not simply because the group has introduced new malware, but because the new backdoor demonstrates a clear investment in stealth, modularity, and operational flexibility. The integration of BOF execution, stack spoofing, reflective PE loading, API hooking, and host-process camouflage suggests that FamousSparrow is increasingly designing its tooling around defeating behavioral monitoring and complicating endpoint analysis rather than relying primarily on conventional malware obfuscation.
The group's integration of open-source offensive-security components directly into SparroWocky is also significant. Rather than deploying these tools separately alongside its proprietary malware, FamousSparrow can now use its primary implant as an extensible platform for additional in-memory capabilities. This reduces the need to introduce additional standalone tooling onto a compromised system while allowing operators to adapt functionality according to operational requirements.
The current concentration on Latin American government organizations also provides insight into the likely intelligence value driving the campaign. ESET assesses that the shift may be connected to China's interest in monitoring regional governments, as US involvement increasingly intersects with Chinese economic and strategic interests. However, the available evidence does not establish whether Latin America represents a permanent geographic mandate for FamousSparrow or a temporary operational priority driven by the current geopolitical climate.
For defenders, the larger takeaway is that FamousSparrow should not be treated solely as a Latin America-focused threat actor. Its historical victimology spans multiple regions and sectors, while SparroWocky's modular architecture provides a platform that can readily support operations against different targets. Organizations with strategically valuable government, diplomatic, trade, legal, research, engineering, or financial information should therefore consider the group's evolving capabilities when assessing exposure to China-aligned cyberespionage activity.
IOCs
PolySwarm has a sample of SparroWocky.
e0b6f8535e19f0a4938e3317de0c4493ecea17aa906fd0454805ba2086cbf3a8
Click here to view all samples of SparroWocky in our PolySwarm portal.
Don’t have a PolySwarm account? Go here to sign up for a free Community plan or subscribe.
Contact us at hivemind@polyswarm.io | Check out our blog | Subscribe to our reports.
