SparroWocky: New APT Backdoor Targets Latin American Governments

ESET discovers SparroWocky, the modular backdoor from China-aligned FamousSparrow that replaced SparrowDoor in August 2025. Eight Latin American countries hit, with unprecedented geopolitical focus.

Since August 2025, the China-aligned APT group FamousSparrow, active since at least 2019, has abandoned its known SparrowDoor backdoor to deploy a new espionage tool: SparroWocky. ESET Research observed the malware in action against government organizations in eight Latin American countries, with an unprecedented concentration: from mid-2025, roughly 90% of targets in ESET telemetry are located in the region. The backdoor's name hides an unmistakable cultural signature: the first stanza of Jabberwocky, Lewis Carroll's nonsense poem, embedded in the earliest analyzed samples.

Key Takeaways

FamousSparrow replaced SparrowDoor with SparroWocky starting August 2025, confirming an ongoing tooling evolution
Eight Latin American countries confirm government targets: Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela
SparroWocky employs advanced anti-analysis techniques, including CreateThread hooking via MinHook to mask thread origins
ESET attributes the operation to FamousSparrow with high confidence and links the geographic focus to U.S. pressure on Chinese investments in the region

From SparrowDoor to SparroWocky: FamousSparrow's Tooling Evolution

FamousSparrow has been a known name in threat intelligence since 2021, when ESET first documented the group behind ProxyLogon exploits against global hotel chains. The transition to SparroWocky marks a significant shift: this is not an incremental variant but an architectural replacement. The backdoor is modular, written in C++, and integrates code from open-source projects — including Beacon Object Files — inside a custom APT malware.

The decision to abandon a consolidated tool like SparrowDoor — of which FamousSparrow is the only known operator — suggests a deliberate operational recalibration. ESET observes that SparroWocky was deployed exclusively through SparrowDoor infrastructure, confirming actor continuity. The source does not specify the exact initial access vector: how the group gains its initial foothold in target networks remains unknown.

Backdoor Anatomy: In-Memory Evasion and Dual Persistence

SparroWocky stands out for an arsenal of anti-analysis techniques designed to render malicious behavior invisible to security tools. Deployment occurs via DLL side-loading: a legitimate file loads a malicious library, which in turn decrypts and maps the main payload into memory from an RC4-encoded .dat file. No executable file is written to disk during the active phase, reducing the detection surface.

Persistence is established through two alternative mechanisms: a Windows service named ProcAuditManager or a registry key called SnapCart. The use of blandly administrative names to mask malicious components aligns with the group's practices.

The most distinctive technique involves thread manipulation. ESET researchers, cited by BleepingComputer, explain:

"SparroWocky uses the MinHook library to hook the CreateThread function in order to conceal the original lpStartAddress parameter from security products. Essentially, any thread created by SparroWocky would have AnimateWindow as the starting address, which would likely be considered legitimate by a security product"

The mechanism exploits a legitimate hooking library to alter the call stack visible to detection tools. Every thread spawned by the malware shows the Windows AnimateWindow function — a standard graphics routine — as its starting point instead of the real malicious address. Combined with runtime code patching, dynamic API resolution, and stack spoofing, the result is infrastructure that researchers describe as indicative of "strong knowledge of anti-analysis tricks and Windows internals."

Command-and-control communication occurs over port 443 or 8080, with support for HTTP and SOCKS5 proxies. At least 18 C2 addresses have been identified, according to BleepingComputer. Screen capture occurs at intervals of roughly 500 milliseconds, a high frequency suggesting interest in real-time monitoring of victim activity.

Latin America at the Center: Geopolitics and Economic Intelligence

FamousSparrow's victimology has undergone a radical transformation. From a globally operating hospitality-sector actor, the group has concentrated — from mid-2025 — overwhelmingly on Latin America. According to ESET, roughly 90% of targets in telemetry fall in the region. Alexandre Côté Cyr, ESET researcher, stated:

"We have seen the new backdoor deployed against governmental entities in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela. This represents a rare occurrence among the China-aligned APT groups that ESET tracks"

The source links this geographic focus to concrete geopolitical dynamics. ESET assesses the objective is intelligence gathering on Latin American governments' reactions to U.S. economic pressure on Chinese interests in the region. An emblematic case: a targeted Panamanian entity is directly involved in the trade dispute over ports in the canal area previously managed by a Chinese company. The target choice is not random: it aims to capture negotiating and regulatory positions influencing Beijing's multi-year investments.

The dossier does not specify the exact content of exfiltrated data nor the precise number of compromised victims. A clear pattern emerges, however: political-economic intelligence has supplanted the purely sectoral interest that characterized the group's early campaigns.

The Cultural Signature: When the Malware Name Is a Message

The name SparroWocky is not an arbitrary researcher label. In the earliest analyzed samples, ESET found the first stanza of Jabberwocky by Lewis Carroll — the famous nonsense poem from Through the Looking-Glass. The choice fits a broader tradition of Chinese APTs incorporating literary or cultural references into their tools, making the malware recognizable to operators and turning it into an internal signaling vehicle.

The reference to the vorpal blade and the frumious Bandersnatch inspired the tone of ESET's analysis. Côté Cyr concluded the technical report with an equally Carrollian quote: the malware, he wrote, is less arcane than a "'gyre and gimble in the wabe,'" and a "'through and through [of] the vorpal blade'" enabled the full analysis. The source does not clarify whether the name is used by the group's own operators or is exclusively a researcher convention.

What to Do Now

Check for ESET IoCs in government and infrastructure networks across Latin America, paying attention to service names ProcAuditManager and SnapCart
Analyze logs for CreateThread activity with lpStartAddress pointing to AnimateWindow, a specific indicator of SparroWocky's MinHook technique
Inspect outbound traffic to HTTP/SOCKS5 proxies on ports 443 and 8080, correlating with the list of 18 C2 addresses identified by ESET
Reassess defenses against modular backdoors with in-memory loading: the absence of executable files on disk requires behavioral detection tools at the memory and thread level

Frequently Asked Questions

Is SparroWocky a variant of SparrowDoor?
No. ESET documents an architectural replacement: starting August 2025, FamousSparrow abandoned SparrowDoor in favor of SparroWocky. Deployment still occurs through SparrowDoor infrastructure, confirming actor continuity.

Why Latin America?
According to ESET, the geographic focus likely reflects Chinese interest in local governments' reactions to U.S. pressure on Chinese economic investments in the region. A Panamanian target is linked to disputes over ports previously managed by Chinese companies.

Is the name SparroWocky used by the hackers themselves?
The dossier does not specify. The Lewis Carroll reference is documented in technical samples, but it is unclear whether it represents the group's internal convention or a researcher label.

The SparroWocky case measures how rapidly Chinese APTs adapt tooling and victimology to geopolitical shifts. The transition from hotels to ministries, from Europe and the Middle East to a Latin America under U.S. commercial pressure, tells an operational evolution that defenders must track with equal agility.

Information verified against cited sources and current as of publication.

Sources

Sources and references

Get DeafLetter