Loading story…
China-aligned cyberespionage group FamousSparrow has deployed a new modular C++ backdoor, SparroWocky, against government entities across Latin America since at least August 2025. The implant appears to replace the group’s earlier SparrowDoor malware and has disproportionately affected organizations in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela; roughly 90% of observed targeting since mid-2025 has been in the region. The campaign is assessed as intelligence collection, potentially focused on government responses to U.S. pressure affecting Chinese economic interests.
SparroWocky supports host reconnaissance, remote command execution, file collection and manipulation, screenshot capture, proxying, persistence, cross-session process creation, and encrypted exfiltration. Operators deliver it through DLL side-loading: an RC4-encrypted payload stored in a .dat file is loaded directly into memory. The malware incorporates open-source offensive tooling and native Beacon Object File execution, while using runtime patching, dynamic API resolution, stack and threat-origin spoofing, and CreateThread hooking to disguise malicious threads as legitimate AnimateWindow activity.
TTPs, infrastructure, and targeting history in one profile.
6 events from the most recent confirmed update back to the earliest known activity.
FamousSparrow deployed the new modular C++ SparroWocky backdoor in a cyberespionage campaign targeting government entities in Latin America. Victims were identified in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela.
Telemetry indicated that FamousSparrow activity became primarily focused on Latin American targets from mid-2025, with government institutions heavily targeted.
FamousSparrow, a China-aligned cyberespionage group, is believed to have operated since at least 2019.
Analysis disclosed that SparroWocky supports reconnaissance, command execution, file exfiltration, screenshots, TCP proxying, reverse port forwarding, and in-memory PE and Beacon Object File execution. It is delivered through DLL side-loading and uses RC4, TLS, API hashing, call-stack spoofing, thread-start concealment, and forged Windows loader structures to evade detection.
SparroWocky was identified as a distinct malware family that appears to have superseded FamousSparrow's SparrowDoor implant. Attribution was supported by overlapping infrastructure and victimology, including SparroWocky deployments by SparrowDoor on previously compromised networks.
Researchers reported that FamousSparrow compromised public-facing Microsoft Exchange servers to gain access and deploy the SparroWocky backdoor against government targets in Latin America. The report also provided loader and backdoor hashes and command-and-control IP indicators.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 22 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
6 references tracked. Mallory keeps watching after this page renders.
mkd-cirt.mk
Open sourcecybersecuritynews.com
Open sourcecryptika.com
Open sourcedecipher.sc
Open sourcebleepingcomputer.com
Open sourcewelivesecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers assessing an espionage campaign targeting East Asian companies since May 2023 said the activity likely focused on semiconductor and rare-metal sectors and used the **Xiangoop Loader** to deliver fileless payloads including **Cobalt Strike Beacon**, **EntryShell**, and in some cases **CrowDoor** through **SparrowDoor Loader**. Malware analysis found strong overlap between EntryShell and the older **KeyBoy** family, including matching embedded and encrypted strings, leading investigators to assess EntryShell as an updated KeyBoy variant. The same research identified technical overlap between **CrowDoor** and **SparrowDoor**, including identical loader shellcode and shared structural and command features, strengthening the case that **Tropic Trooper** and **FamousSparrow** are either the same threat actor or closely aligned operators. Earlier reporting on FamousSparrow described a cyberespionage group active since at least 2019 that exploited internet-facing applications such as **Microsoft Exchange** via **ProxyLogon**, **Microsoft SharePoint**, and **Oracle Opera** to deploy **SparrowDoor**, a backdoor capable of persistence, host reconnaissance, file theft, process creation, shellcode injection, and interactive remote shell access.
Aug 15, 2026
China-aligned threat group **Webworm** has expanded its espionage toolkit with two custom backdoors, **GraphWorm** and **EchoCreep**, using trusted cloud and social platforms for command-and-control. Researchers said **GraphWorm** is a Go-based implant that abuses **Microsoft OneDrive** through the **Microsoft Graph API**, creating a separate workspace for each victim and using cloud folders for tasking, file transfer, shell command execution, configurable sleep intervals, and data exfiltration. **EchoCreep** was observed using **Discord** for C2, while the group also staged malware and supporting tools from a GitHub repository masquerading as a WordPress fork. The activity reflects a broader shift by Webworm away from older RATs such as **Trochilus** and **9002 RAT** toward stealthier proxy and tunneling infrastructure, including **SoftEther VPN**, **WormFrp**, **ChainWorm**, **SmuxProxy**, and **WormSocket**. Victims span government and enterprise organizations across Asia and Europe, including entities in **Belgium, Italy, Serbia, Poland, and Spain**, as well as a university in **South Africa**; researchers also linked a compromised **Amazon S3** bucket to proxy configuration storage and exfiltrated data, including VM snapshots and government documents. Investigators observed the group using tools such as **Nuclei** and **dirsearch**, along with a script exploiting a known post-authentication RCE flaw in **SquirrelMail**, indicating active targeting of exposed web applications for initial access.
Jun 29, 2026
The **SideWinder** APT group has intensified espionage operations across South Asia, targeting government, military, and public-sector entities in countries including **Sri Lanka, Bangladesh, and Pakistan**. Researchers reported spear-phishing campaigns using malicious Word and RTF documents that exploited `CVE-2017-0199` and `CVE-2017-11882`, alongside geofenced delivery, shellcode loaders, server-side polymorphism, and DLL sideloading to limit payloads to intended victims and evade analysis. Confirmed targets included the **Central Bank of Sri Lanka** and the **Sri Lanka Army’s 55th Division Battalion**, with infrastructure such as `army-govbd[.]info` supporting multi-stage infections that ultimately deployed **StealerBot** for credential theft, reconnaissance, persistence, and data exfiltration. Separate reporting tied SideWinder to a newer Pakistan-focused campaign delivering a backdoor called **WarHawk** through malicious ISO files hosted on Pakistan’s **National Electric Power Regulatory Authority** website and lures copied from legitimate Cabinet Division advisories. WarHawk profiled infected systems, executed commands, enumerated files, and transferred additional payloads, including a custom **Cobalt Strike** loader that used **KernelCallbackTable injection** and a Pakistan Standard Time check to constrain execution. Earlier research also linked SideWinder to Android spyware distributed through **Google Play** as fake VPN, cleaning, and religious apps, showing the group’s broader use of mobile and desktop malware, reused infrastructure, and regionally tailored delivery to sustain long-running intelligence collection in South Asia.
Aug 15, 2026