SparroWocky Backdoor Gives FamousSparrow a Stealthier Foothold in Latin American Governments

China-linked espionage group FamousSparrow has deployed a newly identified Windows backdoor against government organizations across Latin America, combining broad surveillance capabilities with unusually elaborate techniques for hiding malicious activity in memory.

The malware, named SparroWocky, was observed in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela. The operations had already continued for more than a year when reported, while ESET telemetry indicates that the group concentrated primarily on Latin American targets from mid-2025 onward.

The suspected intelligence objective was to monitor how governments in the region were responding to growing U.S. pressure on Chinese economic interests. SparroWocky also appears to represent a technical transition for FamousSparrow, replacing its earlier custom backdoor, SparrowDoor.

A government espionage tool built for extended access

SparroWocky is a modular backdoor written in C++. It gives an operator both conventional remote-access functions and capabilities designed for intelligence collection inside compromised government networks.

Once active, the malware can execute commands and launch executable files. It can also load Beacon Object Files directly into memory, allowing operators to extend its behavior without necessarily writing additional tools to disk.

Its reconnaissance commands gather details about the infected computer, network configuration, current user, Windows domain, and operating system version. SparroWocky can enumerate drives, folders, files, connected displays, and active user sessions, providing the attacker with a detailed map of the host and its users.

File operations are similarly extensive. The backdoor can upload and download data, as well as copy, move, rename, or delete files. These functions support both document theft and the manipulation of material stored on a compromised system.

Surveillance extends to screenshots captured every 500 milliseconds. To reduce the amount of transmitted data, SparroWocky sends an initial full-screen image and then transfers only regions that have changed. That design could allow sustained visual monitoring while limiting bandwidth and making network activity less conspicuous.

The malware can also create processes inside another logged-in user’s session. This may expose information or applications unavailable in the original context, particularly on shared systems or servers with multiple interactive sessions.

Finally, SparroWocky can operate as a TCP proxy and forward network connections. A compromised government endpoint could therefore become a relay for reaching additional systems or obscuring the origin of attacker traffic.

DLL side-loading and memory-only payload mapping

The observed delivery chain uses DLL side-loading, a technique in which a legitimate executable is induced to load a malicious library placed where Windows will find it. This can make execution appear connected to trusted software and complicate detections based only on process identity.

A loader retrieves the core payload from a .dat file, decrypts the RC4-encoded content, and maps it directly into memory. Avoiding a conventional executable payload on disk reduces the artifacts available to file-based antivirus products and forensic investigators.

The exact legitimate executables, DLL names, and .dat filenames used across the intrusions have not been disclosed. No initial-access mechanism has been identified either, so it is not known how FamousSparrow first reached each targeted environment before deploying the side-loading chain.

No software vulnerability or CVE is associated with the campaign. Consequently, there is no reported CISA Known Exploited Vulnerabilities catalog entry, remediation deadline, or vendor patch tied to SparroWocky. This is a malware and intrusion-detection problem rather than a conventional vulnerability-management case.

The affected operating-system scope is Windows, but specific Windows editions and versions have not been disclosed.

Thread manipulation is designed to mislead endpoint tools

Some of SparroWocky’s most distinctive behavior targets the telemetry that endpoint security products use to explain how code began running.

The backdoor incorporates call-stack spoofing, threat-origin spoofing, and dynamic API resolution. It also attempts to present malicious in-memory code and loaded DLLs as legitimate Windows components. Together, these measures can weaken detections that rely on recognizable API calls, suspicious memory provenance, or abnormal execution chains.

SparroWocky uses the open-source MinHook library to intercept the Windows CreateThread function. During legitimate thread creation, the lpStartAddress parameter identifies the address where the new thread should begin executing. Security tools can inspect that value to determine whether a thread starts inside a trusted module, an unusual memory region, or injected code.

The malware conceals the original lpStartAddress and makes its threads appear to begin at AnimateWindow, a legitimate Windows function. A monitoring product may therefore see an apparently benign thread origin instead of the malware’s actual entry point.

This does not make the underlying activity invisible. It does, however, mean defenders should avoid treating a thread’s reported start function as definitive without also examining memory allocation, module boundaries, call stacks, hooks, and subsequent behavior.

ESET identified at least 18 command-and-control addresses communicating with SparroWocky. Connections occurred directly over TCP ports 443 or 8080, or through HTTP and SOCKS5 proxies. Individual addresses and other network indicators have not been publicly specified in the available reporting.

Persistence changes according to available privileges

SparroWocky selects its persistence mechanism based on the level of access it has obtained.

With sufficient privileges, it can install a Windows service named:

ProcAuditManager

Alternatively, it can create a registry value called:

SnapCart

The value may appear under either HKLM or HKCU. The use of HKLM can provide machine-wide persistence, while HKCU offers an option tied to the current user when higher privileges are unavailable.

Both names are useful hunting pivots, but neither should be treated as conclusive evidence in isolation. Investigators should correlate them with the associated executable paths, creation time, parent process, loaded DLLs, .dat files, and outbound network activity.

The malware also contains cleanup functions. Operators can remove persistence and delete SparroWocky’s files, potentially reducing the evidence left behind after collection or command execution. Organizations should therefore retain endpoint, service-control, registry, proxy, and network telemetry outside the affected host whenever possible.

Why the campaign poses a serious intelligence risk

The targeting and tooling point to intelligence collection rather than indiscriminate cybercrime. Government systems can contain diplomatic communications, internal policy discussions, economic planning documents, and information about negotiations with foreign partners.

SparroWocky supports several collection paths at once. Operators can steal documents directly, watch activity through frequent screenshots, inspect user sessions, execute additional in-memory modules, and route traffic through compromised machines.

Proxy functionality also raises the possibility that an infected endpoint could be used to reach other internal services. The available findings do not disclose whether lateral movement occurred in the observed incidents, so the extent of any broader network compromise is not known.

ESET assessed the developers as technically capable, based on the malware’s modular architecture, manipulation of Windows internals, and extensive anti-analysis functionality. These qualities are consistent with a well-resourced and experienced espionage operation. A technical report on the FamousSparrow campaign also describes SparroWocky as the apparent successor to SparrowDoor.

Defensive priorities for Windows environments

No vendor patch or dedicated removal utility has been reported. Defensive action must therefore focus on ESET’s indicators of compromise, behavioral hunting, containment, and forensic review.

Security teams should ingest the available IoCs into endpoint, network, proxy, and SIEM platforms. Monitoring should cover outbound traffic over ports 443 and 8080, but port numbers alone are weak indicators because both are widely used for legitimate services. HTTP and SOCKS5 proxy behavior should also be reviewed for unusual destinations, processes, and connection patterns.

Endpoint investigations should prioritize:

• Unexpected DLL side-loading involving legitimate executables, unfamiliar DLLs, and encrypted .dat payloads.
• RC4 decryption followed by executable memory allocation or direct payload mapping.
• In-memory execution of Beacon Object Files.
• Creation of the ProcAuditManager service.
• A SnapCart persistence value under HKLM or HKCU.
• Hooks placed on CreateThread, particularly through MinHook.
• Threads reported as starting at AnimateWindow when their memory and call-stack context do not match normal Windows behavior.
• Processes launched inside another user’s active session.
• Rapid screenshot collection and repeated transmission of changed screen regions.
• TCP forwarding, HTTP proxying, or SOCKS5 activity from systems that do not normally provide those functions.
• Attempts to remove services, registry persistence, payload files, or other execution artifacts.

Any confirmed indicator should trigger broader scoping rather than simple file deletion. Defenders need to determine how access was obtained, which accounts and sessions were exposed, what files were accessed, whether the host relayed traffic, and whether SparroWocky executed additional in-memory components.

Because the initial compromise vector remains unknown, removing the backdoor without identifying the entry path may leave the environment vulnerable to renewed access.