ESET Uncovers New FamousSparrow Backdoor Deployed Against Latin American Governments

ESET researchers Alexandre Côté Cyr and Romain Dumont have documented SparroWocky, a previously undocumented modular C++ backdoor that ESET attributes with high confidence to FamousSparrow, a China-aligned cyberespionage group. ESET published its analysis on Sept. 17, 2026.

ESET says the backdoor is designed to give operators persistent, covert access to compromised machines and replaces the group's earlier SparrowDoor implant. According to the researchers, SparroWocky is a distinct malware family, not a variant of SparrowDoor.

ESET's telemetry shows SparroWocky deployed against government entities in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela since August 2025. From mid-2025 into 2026, 90% of FamousSparrow's targets in ESET's telemetry have been in the region, the researchers report.

ESET bases its attribution on two technical grounds: in early attacks, SparroWocky was deployed by SparrowDoor, a backdoor ESET says only FamousSparrow uses; and the victimology matches FamousSparrow's earlier targeting patterns, with the researchers recording attempts to deploy SparroWocky at organizations previously targeted with SparrowDoor.

According to ESET's analysis, SparroWocky can execute files, act as a TCP proxy, run shell commands, take screenshots periodically, and exfiltrate files. The backdoor encrypts exfiltrated data with RC4 and transmits it over TLS. It establishes persistence either as a Windows service or through a registry run key, depending on its configuration.

SparroWocky also incorporates code from several open-source projects, including the Mbed TLS cryptographic library and MinHook, a Windows API hooking library, the researchers note. ESET's full technical writeup, including indicators of compromise, is published on WeLiveSecurity.