FamousSparrow swaps in a new backdoor for Latin America

ESET says the China-aligned espionage group FamousSparrow has retired its long-serving SparrowDoor implant in favour of a new backdoor it calls SparroWocky, used against government bodies across Latin America since at least August 2025. The researchers attribute the campaign to FamousSparrow with high confidence and describe SparroWocky as a distinct malware family rather than a revision of the older tool.

A regional shift, then a new tool

The pivot to Latin America came first. ESET says the group narrowed its targeting to the region almost exclusively from July 2025, and that 90% of the targets it has recorded from mid-2025 into 2026 sit there. Within roughly a month, SparroWocky had appeared and quickly supplanted SparrowDoor as the group's main implant.

ESET lists government entities in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico and Venezuela among those affected. It reads the focus as a reaction to renewed US attention on Latin America, noting that one affected Panamanian body is caught up in the commercial dispute over two canal-area ports that a China-based operator ran until the concession was legally challenged in early 2025.

What the backdoor does

SparroWocky is a modular, C++ backdoor built for stealth. It can run arbitrary files, act as a TCP proxy, execute commands, and pull basic machine details such as the computer name, username, domain, Windows version and interface addresses. It exfiltrates files and takes screenshots on a schedule, encrypting what it steals with RC4 and sending it over TLS. It can hold its position either through a dedicated service or a registry Run key, and it can load and execute Beacon Object Files.

ESET says the group has also folded open-source tooling directly into the malware, where before it deployed such tools alongside SparrowDoor. Delivery follows a trident loader pattern: a legitimate executable, a tampered DLL that stands in for one the executable expects, and a data file holding an encrypted payload. The payload file carries a magic value of 0x11328712, a 16-byte RC4 key and a stripped portable executable that is mapped into memory rather than written to disk.

Named after a poem, tracked apart from Salt Typhoon

ESET chose the name SparroWocky because early samples contain the opening stanza of Lewis Carroll's Jabberwocky, text the researchers trace to the test vectors in RFC 7539, the specification for ChaCha20-Poly1305, even though the backdoor does not use that cipher. The analysis is based largely on a sample compiled on 17 November 2025, carrying version 1.8.

On attribution, ESET is careful where others have not been. It notes that FamousSparrow has been publicly linked to Salt Typhoon but says that, in the absence of any technical indicators, the two are tracked separately. Trend Micro has tied FamousSparrow to Earth Estries, a link ESET describes as real but not fully understood.

Our opinion

Plenty of coverage reached for Salt Typhoon the moment this research landed, and the primary document does not support the shortcut. ESET states the link exists in public reporting and then declines to act on it, because no technical indicators join the two, and it attributes SparroWocky to FamousSparrow on evidence that holds up: a SparrowDoor-exclusive loader delivering the new implant, and victims that overlap the group's previous targeting. That restraint matters practically. A threat-actor name decides which country gets asked to answer for an intrusion, and it decides which defences enterprises benchmark against.

The other lesson is quieter, and it is about libraries. FamousSparrow lifted the first lines of Jabberwocky into its flagship malware because the text sits in a public specification's test vectors and someone copied it into production code. Researchers got a naming convention and a fingerprint out of somebody else's carelessness. The group had already shown how quickly it will retire a tool once it believes it is being watched, replacing SparrowDoor within about a month of a geopolitical shift. That combination, an exposed code trail and a short attention span for compromised implants, is what defenders should expect next time as well.