A China-aligned espionage group has quietly swapped out its signature tool and pointed the replacement at Latin America. ESET researchers report that FamousSparrow, a crew they have tracked since 2019, has largely abandoned the SparrowDoor backdoor it was known for in favour of a new one, SparroWocky, and has been deploying it against government organisations across the region since at least August 2025. From mid-2025 into 2026, 90 percent of the group's targets in ESET's telemetry sat in Latin America, a concentration the researchers call rare among the China-aligned groups they track.
Eight governments, one region
ESET has seen the new backdoor deployed against government entities in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico and Venezuela. Its reading of why is explicitly geopolitical: an aggressive reassertion of US interests in the region threatens investments China has built across the continent over the last decade in energy, mining and telecommunications, and the activity looks intended to help Beijing anticipate how local governments will respond.
One case is concrete. Among the Panamanian bodies targeted is one directly involved in the commercial dispute over two ports in the canal area that were, until recently, operated by a China-based company. Panama's government legally challenged that concession in early 2025, and ESET assesses it as highly likely the operation was meant to give early sight of what the authorities intended to do. The researchers are careful to say they cannot tell whether the regional focus is a formal mandate or a temporary redirection.
A backdoor named after a nonsense poem
SparroWocky is a modular C++ backdoor, and ESET stresses it is a distinct family rather than a new version of SparrowDoor. The name comes from the first stanza of Lewis Carroll's Jabberwocky, which ESET found in the early samples. The verse is a test vector in the ChaCha20-Poly1305 encryption specification, which the malware does not actually use.
It runs files, proxies TCP traffic, executes commands, takes periodic screenshots and steals files, encrypting what it exfiltrates with RC4 and sending it over TLS. It can also load Beacon Object Files, the small in-memory modules red teaming tools use, letting an operator add capability without replacing the implant. Persistence is a Windows service or a registry run key; in the configuration ESET extracted, the service hides under the name ProcAuditManager.
How ESET ties it back
The attribution rests on deployment rather than code. In some of the first attacks involving the new backdoor, SparroWocky was dropped by SparrowDoor, which ESET says only FamousSparrow uses, and the victims overlap with organisations the group had already hit with the older implant. ESET attributes the campaign with high confidence.
Its relationship to other Chinese clusters is less settled. Trend Micro has linked FamousSparrow to Earth Estries, though ESET says the nature of that link is not fully understood, and it has been publicly linked to Salt Typhoon as well, which ESET declines to accept for want of technical indicators and tracks separately. Those are open questions, not settled equivalences.
Hunt the loader, not the file name
There is no patch, because this is tooling rather than a vulnerability. ESET has published a full technical analysis with indicators, including the sample it worked from (SHA-1 44f0a22b143b79fa760bf31e14c8fff714c8a2a1) and the command and control address 216[.]238[.]110[.]120 on port 443.
The durable signal is structural. ESET describes a three-part loader: a legitimate executable, a malicious library standing in for one it needs, and an encrypted payload file alongside. So look for a signed binary loading a library out of its own directory when it should be loading a system one, and for services whose descriptions read plausibly but whose binaries do not sit where that vendor installs things. Latin American governments have spent this year absorbing a steady run of financially motivated intrusions. The quieter kind never left.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.