Malware
FamousSparrow Deploys SparroWocky Backdoor Across Latin America
The state‑sponsored group FamousSparrow has rolled out a new modular C++ backdoor, SparroWocky, targeting government and critical infrastructure in Latin America since August 2025. The implant can execute arbitrary code, act as a TCP proxy, exfiltrate data, and hide its presence using MinHook and COFF Loader techniques. Defenders should block the known C2 IP, monitor for suspicious TLS traffic, and detect MinHook‑based thread hiding.
FamousSparrow, a China‑aligned threat actor, has deployed a previously unseen backdoor called SparroWocky in attacks against multiple Latin‑American countries since at least August 2025.
What happened
SparroWocky is a modular C++ implant that replaces the group’s earlier SparrowDoor. It can execute arbitrary files, act as a TCP proxy, run commands, take screenshots, exfiltrate files, and delete itself from the host. The malware uses Mbed TLS to establish a secure channel to the command‑and‑control server at 216.238.110.120, MinHook to hide the start address of newly created threads, and COFF Loader to load dynamic in‑memory plugins. It also employs a variant of SilentMoonwalk/StackMoonwalk to spoof call stacks.
Impact
- Targets: government entities and critical infrastructure in Latin America.
- Capabilities: remote code execution, data exfiltration, stealth persistence.
- Overlap: shares tooling with Earth Estries and Salt Typhoon.
What to do
- Block outbound TLS traffic to 216.238.110.120 and any related subnets.
- Deploy host‑based detection that flags MinHook usage and COFF Loader activity.
- Inspect for suspicious DLL injection, in‑memory plugin loading, and unexpected screenshot files.
- Apply the latest Windows security updates and enforce least‑privilege for user accounts.
- Segment networks to limit lateral movement and monitor for anomalous TCP proxy behavior.
Mitigation
- Use endpoint detection and response (EDR) to detect and quarantine the backdoor.
- Enable logging of TLS connections and analyze for anomalies.
- Implement application whitelisting to block unauthorized executables.
Related articles
Chinese Espionage Group Deploys New SparroWocky Backdoor in Latin America
FamousSparrow, a China‑linked threat actor, has moved beyond its old SparrowDoor tool and rolled out the modular C++ backdoor SparroWocky against government entities across Latin America. The malware uses sophisticated anti‑analysis tricks—DLL side‑loading, RC4‑encoded payloads, dynamic API resolution, and CreateThread hooking—to evade detection. It can execute commands, exfiltrate data, capture high‑frequency screenshots, proxy traffic, and even wipe its own traces. ESET’s analysis pinpoints 18 C2 endpoints and shows the operation has been active for over a year, targeting Argentina, Ecuador,
Read briefing
Rapid7 Partners with Licencias OnLine to Expand AI‑Driven Security Ops in Latin America
Rapid7 has partnered with Licencias OnLine to bring its AI‑powered security operations platform to Latin America, enabling organizations to unify exposure management, threat detection, and automation across endpoints, cloud, identity, and infrastructure. The partnership focuses on eliminating blind spots such as Shadow IT and Shadow AI while supporting rapid digital transformation. Defenders should assess current coverage, integrate the platform, and leverage local expertise for accelerated deployment.
Read briefing
Group-IB Expands Cybercrime Intelligence Operations in Latin America
Group‑IB has launched a focused intelligence program to counter rising cybercrime in Latin America, highlighting local threat actors and tactics. The initiative offers a Unified Risk Platform and threat‑intelligence services to help SecOps teams detect, prevent, and respond to fraud, ransomware, and brand abuse. Defenders should integrate Group‑IB solutions, monitor regional threat feeds, and adopt the platform’s attack‑surface and digital‑risk protection modules.
Read briefing
MacSync macOS Infostealer Adopts Binary Droppers and iCloud Staging
Security researchers have detailed an updated campaign involving the MacSync macOS infostealer and backdoor, targeting crypto users and developers. The latest variant abandons script-based droppers in favor of compiled Objective-C and Swift binaries, leveraging iCloud for payload delivery during multi-stage infections.
Read briefing