For over a year, the China-aligned espionage group **FamousSparrow** has been actively targeting government entities in Latin America. Their latest tool of choice for these operations is **SparroWocky**, a new backdoor that supersedes their previously identified **SparrowDoor** malware. **ESET** researchers have documented the deployment of **SparroWocky** in attacks against organizations in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela. ### Strategic Intelligence Gathering The primary objective of these operations, as assessed by **ESET**, appears to be the collection of intelligence regarding Latin American governments' responses to increasing U.S. pressure on Chinese economic interests.  ### SparroWocky's Advanced Capabilities **ESET**'s in-depth analysis reveals **SparroWocky** as a modular, full-featured C++ backdoor. It incorporates code from various open-source projects and boasts robust anti-analysis mechanisms, including the manipulation of low-level memory structures and runtime code patching. The backdoor's extensive capabilities include: * Executing commands and launching executable files. * Loading and executing **Beacon Object Files** in memory. * Gathering comprehensive system, network, user, domain, and Windows version details. * Enumerating drives, directories, files, displays, and active user sessions. * Performing file operations such as uploading, downloading, copying, moving, renaming, and deleting. * Capturing screenshots every 500 milliseconds, with subsequent transmissions limited to changed screen regions after an initial full-screen capture. * Creating processes within other logged-in user sessions. * Operating as a TCP proxy and forwarding connections. * Removing its own persistence mechanisms and deleting its files. ### Evasion and Persistence Techniques **SparroWocky** is typically deployed via DLL side-loading. A loader decrypts an **RC4**-encoded payload from a `.dat` file and maps it directly into memory, a common evasion tactic. The malware employs several sophisticated evasion techniques, including call stack and threat origin spoofing, dynamic API resolving, and disguising malicious in-memory code and DLLs as legitimate Windows components. To further elude security solutions, **SparroWocky** intercepts the Windows thread creation process to alter the start address. **ESET** explains: "**SparroWocky** uses the **MinHook** library to hook the `CreateThread` function in order to conceal the original `lpStartAddress` parameter from security products. Essentially, any thread created by **SparroWocky** would have `AnimateWindow` as the starting address, which would likely be considered legitimate by a security product." Persistence is established either through a Windows service named `ProcAuditManager` or by adding a Windows registry key, `SnapCart`, under **HKLM** or **HKCU**, depending on the available privileges. These advanced architectural and evasion techniques underscore the threat actor's profound knowledge of anti-analysis tricks and Windows internals, reinforcing the attribution to a well-resourced and experienced group. ### Command and Control Infrastructure During their analysis, **ESET** identified at least 18 command-and-control (C2) addresses. These communicate with the malware directly over ports 443 or 8080, or indirectly through HTTP and **SOCKS5** proxies. **ESET**'s telemetry indicates that **FamousSparrow**'s operational focus has primarily been on the Latin American region since mid-2025. **ESET**'s comprehensive report includes a detailed technical analysis of the **SparroWocky** backdoor and provides a list of indicators of compromise (**IoCs**) associated with this campaign, available on their GitHub repository.