FamousSparrow replaced SparrowDoor with SparroWocky in a year of Latin American intrusions
ESET traced more than a year of espionage against government organizations in eight Latin American countries and territories to a modular C++ implant that hooks CreateThread so every thread it spawns looks like AnimateWindow.
The Watch · Security desk
What happened
- ESET attributes a new backdoor called SparroWocky to the China-linked group FamousSparrow, in attacks on government organizations in Latin America that have run for more than a year.
- The researchers observed the malware against organizations in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico and Venezuela.
- SparroWocky replaces SparrowDoor, the custom backdoor FamousSparrow had been using until now.
- ESET believes the objective was collecting intelligence on how Latin American governments are responding to increasing U.S. pressure on Chinese economic interests.
- At least 18 command-and-control addresses were seen talking to the malware directly over port 443 or 8080, or through HTTP and SOCKS5 proxies.
Why it matters
- What it limits constraint Any FamousSparrow coverage keyed to SparrowDoor's loaders, file names and infrastructure is now looking for a tool the group has stopped using, and that hunting work has to be redone against the new indicator set.
- What's now possible capability The CreateThread hook takes the thread start address away as a triage signal: an analyst or product inspecting a suspicious thread sees AnimateWindow and has no reason to escalate.
- Who's exposed exposure If ESET's read of the motive is right, the collection target is whichever ministries and trade bodies handle U.S.-China policy, and those sit in governments beyond the eight where telemetry caught the implant.
- Who has to decide decision Blocking the published addresses is quick and will not outlast the next rotation, so the choice is whether to fund the endpoint telemetry that would surface a service or registry key by name.
Next story · Security · 2d ago
Open staging directories and GitHub history expose UAT-6275's four-chain campaign against CIS governmentsConfirmed4 publishers
Persistence is the cheapest place to look. SparroWocky installs either as a Windows service named ProcAuditManager or as a registry key named SnapCart under HKLM or HKCU, depending on the privileges it has [18]. Delivery is DLL side-loading. A loader decrypts an RC4-encoded payload held in a .dat file and maps it directly into memory [12]. ESET's account does not describe how the group gets its first foothold on a host.
For anyone triaging threads, the hook is the important part. "SparroWocky uses the MinHook library to hook the CreateThread function in order to conceal the original lpStartAddress parameter from security products," ESET said [9]. "Essentially, any thread created by SparroWocky would have AnimateWindow as the starting address, which would likely be considered legitimate by a security product" [10]. The same build spoofs call stacks and thread origins, resolves APIs dynamically, and disguises its in-memory code and DLLs as legitimate Windows components [7]. It also manipulates low-level structures in memory and patches code at runtime [5].
Screen capture runs every 500 milliseconds, and after the first full-screen image only the changed regions are transmitted [6]. At that interval a compromised desktop yields 7,200 frames an hour [19]. The backdoor also runs commands and executables, loads Beacon Object Files in memory, enumerates drives, files, displays and active user sessions, creates processes in another logged-in user's session, works as a TCP proxy, and can remove its persistence and delete its own files [8].
ESET describes SparroWocky as a modular, full C++ backdoor that reuses code from open-source projects [11]. The researchers said its architecture and evasion techniques "indicate strong knowledge of anti-analysis tricks and Windows internals" [15].
The campaign detail defenders can act on is the tool swap. SparrowDoor, the custom backdoor FamousSparrow used before, has been replaced in these operations [4], so signatures, hunts and network indicators built for that family do not match what is running now. ESET's telemetry puts the group's primary focus on Latin America from mid-2025 [13]. The report carries the technical analysis and a list of indicators of compromise [17].
What to watch
- Whether ESET or another vendor reports SparroWocky outside the eight countries and territories named so far.
- Rotation of the 18 published command-and-control addresses now that they are in a public report.
- Whether the ProcAuditManager service name and SnapCart registry key survive into the next build after publication.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence70
- Adoption
- Not scored
- Hype gap+5
- Incentives
- Not scored
- Confidence68
Perspective Coverage
5 publishers- Builder
- Builder 22%
- Operator
- Operator 68%
- Investor
- Investor 10%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
The China-linked espionage group FamousSparrow has been using a new backdoor named SparroWocky in attacks on government organizations in Latin America, in operations ongoing for more than a year.
- [2]
ESET researchers observed SparroWocky in attacks targeting organizations in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela.
- [3]
The researchers believe the threat actor's objective was to collect intelligence on Latin American governments' responses to increasing U.S. pressure on Chinese economic interests.
- [4]
The new malware, SparroWocky, replaces the previously used SparrowDoor custom backdoor.
- [5]
SparroWocky's anti-analysis mechanisms include manipulating low-level structures in memory and patching code at runtime.
- [6]
SparroWocky captures screenshots every 500 milliseconds, transmitting only changed screen regions after the first full-screen image.
- [7]
Evasion mechanisms include call stack and thread origin spoofing, dynamic API resolving, and disguising malicious in-memory code and DLLs as legitimate Windows components.
- [8]
Capabilities include running commands and executable files, loading and executing Beacon Object Files in memory, collecting system, network, user, domain and Windows-version details, enumerating drives, directories, files, displays and active user sessions, file upload, download, copy, move, rename and delete, creating processes in another logged-in user's session, operating as a TCP proxy and forwarding connections, and removing its persistence and deleting its own files.
- [9]
"SparroWocky uses the MinHook library to hook the CreateThread function in order to conceal the original lpStartAddress parameter from security products."
- [10]
"Essentially, any thread created by SparroWocky would have AnimateWindow as the starting address, which would likely be considered legitimate by a security product."
- [11]
ESET's analysis found SparroWocky is a modular, full-blown C++ backdoor that includes code from open-source projects.
- [12]
The malware is deployed via DLL side-loading after a loader decrypts the RC4-encoded payload contained in a .dat file and maps it directly in memory for evasion.
- [13]
ESET's telemetry indicates that from mid-2025, FamousSparrow's focus has been primarily on targets in the Latin America region.
- [14]
ESET named eight countries and territories where SparroWocky activity was observed.
- [15]
The researchers said the malware's architecture and evasion techniques "indicate strong knowledge of anti-analysis tricks and Windows internals", aligning with their attribution to a well-resourced and experienced threat group.
- [16]
ESET found at least 18 command-and-control addresses communicating with the malware directly over port 443 or 8080, or through HTTP and SOCKS5 proxies.
- [17]
ESET's report includes a technical analysis of the SparroWocky backdoor and a list of indicators of compromise associated with the activity.
- [18]
SparroWocky establishes persistence either through a Windows service (ProcAuditManager) or by adding a Windows registry key (SnapCart) under HKLM or HKCU, depending on the available privileges.
- [19]
A 500 millisecond screenshot interval produces 7,200 captures per hour.
Sources
5 independent publishers whose own reporting we read for this story.
- bleepingcomputer.comChinese hackers use SparroWocky malware in govt espionage attacks
1 article · September 17, 2026
- infosecurity-magazine.comFamousSparrow Swaps SparrowDoor For New SparroWocky Backdoor
1 article · September 17, 2026
- thehackernews.comChina-Aligned FamousSparrow Deploys SparroWocky Backdoor Across Latin America
1 article · September 17, 2026
- therecord.mediaChina’s FamousSparrow hackers target Latin America with new backdoor
1 article · September 17, 2026
- welivesecurity.comBeware the SparroWock: The backdoor that bites, the commands that catch
1 article · September 17, 2026
Topics and entities
Topics
- DLL side-loading into trusted agents
- Malware evasion techniques
- Cyber Espionage
Entities
- Alexandre Côté Cyr
- ESET
- Salt Typhoon
- Trend Micro