ESET details FamousSparrow’s SparroWocky backdoor in Latin American government attacks
Summary
ESET reports that FamousSparrow has used the modular C++ SparroWocky backdoor against government organizations across Latin America for more than a year, replacing SparrowDoor. The malware supports espionage, evasion, and persistence.
Key points
- ESET observed attacks against government organizations in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela.
- SparroWocky is a modular C++ backdoor that replaced the group’s earlier SparrowDoor malware.
- The malware can run commands, collect system and user data, transfer or delete files, capture screenshots, and proxy network traffic.
- ESET says the backdoor is deployed through DLL side-loading after a loader decrypts an RC4-encoded payload and maps it into memory.
- Its evasion techniques include runtime code patching, API resolving, call-stack and threat-origin spoofing, and disguising malicious code as Windows components.
- SparroWocky establishes persistence through a Windows service or registry key, depending on available privileges.
- ESET found at least 18 command-and-control addresses and assesses the campaign as focused on Latin American targets from mid-2025; the researchers believe it seeks intelligence on governments’ responses to U.S. pressure on Chinese economic interests.
Article Details
- Attack Vectors
- FamousSparrow deployed SparroWocky against government organizations in Latin America, using DLL side-loading after a loader decrypted an RC4-encoded payload in a .dat file and mapped it in memory.
- SparroWocky established persistence through a Windows service named ProcAuditManager or a registry key named SnapCart under HKLM or HKCU.
- The malware communicated with command-and-control addresses over port 443 or 8080, directly or through HTTP and SOCKS5 proxies.
MITRE ATT&CK
T1005 · Data from Local SystemSparroWocky enumerated and handled local files, including uploading and copying them.T1016 · System Network Configuration DiscoveryThe malware collected network details.T1071.001 · Web ProtocolsResearchers reported that the malware communicated with C2 addresses through HTTP.T1082 · System Information DiscoveryThe malware collected system and Windows-version details.T1090 · ProxyThe malware could operate as a TCP proxy and forward connections, and researchers reported SOCKS5 proxy use in its communications.T1113 · Screen CaptureSparroWocky captured screenshots every 500 milliseconds and transmitted changed screen regions after the first full-screen image.T1140 · Deobfuscate/Decode Files or InformationA loader decrypted the RC4-encoded payload contained in a .dat file.T1543.003 · Windows ServiceSparroWocky established persistence through a Windows service named ProcAuditManager.T1547.001 · Registry Run Keys / Startup FolderSparroWocky established persistence by adding the SnapCart registry key under HKLM or HKCU.T1574.002 · DLL Side-LoadingSparroWocky was deployed via DLL side-loading.
Threat Actors
Malware
SparrowDoorFamousSparrow has been using a new C++ backdoor called SparroWocky to spy on government organizations across Latin America, replacing its older SparrowDoor malware.SparroWockyFamousSparrow has been using a new C++ backdoor called SparroWocky to spy on government organizations across Latin America, replacing its older SparrowDoor malware.
Products
Tools
Countries
ArgentinaESET researchers observed SparroWocky in attacks targeting organizations in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela.EcuadorESET researchers observed SparroWocky in attacks targeting organizations in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela.GuatemalaESET researchers observed SparroWocky in attacks targeting organizations in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela.HondurasESET researchers observed SparroWocky in attacks targeting organizations in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela.PanamaESET researchers observed SparroWocky in attacks targeting organizations in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela.PeruESET researchers observed SparroWocky in attacks targeting organizations in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela.VenezuelaESET researchers observed SparroWocky in attacks targeting organizations in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela.