INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

FamousSparrow APT Spies on US Politics in Latin America

| 2026-09-17 13:56 CRITICAL LOW MALWARE & BOTNETS STATE-SPONSORED & ESPIONAGE
JSON
Executive Summary
AI-generated
A Chinese cyber-espionage group known as "FamousSparrow" is using a revamped backdoor called "SparroWocky" to spy on government agencies in the Latin American region, particularly those that host Chinese investments being scrutinized by the Trump administration. The attack began in July 2025 when FamousSparrow pivoted exclusively targeting government organizations in Latin America; it then changed its modus operandi later that year to become China's eyes and ears in the global southwest. This APT is associated with, but not definitively confirmed to be related to, Earth Estries and Salt Typhoon. The attack works by executing malware in-memory, encrypting command-and-control traffic, automating self-deletion, and using stack spoofing to avoid detection. As of September 2026, the current status of this incident is unclear, but it has been reported that FamousSparrow's SparroWocky malware incorporates Beacon Object Files (BOFs) for added functionality.
Technical Mitigations AI-generated
• SparroWocky malware, CVE-2025-XXXX (unspecified), should be patched immediately to prevent exploitation. • FamousSparrow's use of Beacon Object Files (BOFs) from Cobalt Strike and other penetration testing developers indicates a technique to detect their malicious activities. • The modular C++ program deployed via dynamic link library (DLL) sideloading is an indicator of the threat actors' efforts to avoid detection.
Technical Observables Login Required
Indicators of Compromise (IoCs) Protected

Raw threat telemetry, malicious IP addresses, file hashes, and direct VirusTotal correlation are restricted to authenticated users.

Sign In to View 1 IoCs Create Free Account
ch•••••.html
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Salt TyphoonSalt Typhoon Cobalt StrikeCobalt Strike
Target & Sectors
NORTH_AMERICA NORTH_AMERICA LATAM LATAM hospitalityhospitality automotiveautomotive mediamedia governmentgovernment
Incident Timeline
‎July 2025
Threat actors aligned with China deployed the SparroWocky backdoor exclusively to target government organizations in Latin America.
target_region LATAM
Chinese Cyberattacks in Latin America In July 2025, ESET researchers observed FamousSparrow pivot to exclusively targeting government organizations in Latin America.
industry Government
Chinese Cyberattacks in Latin America In July 2025, ESET researchers observed FamousSparrow pivot to exclusively targeting government organizations in Latin America.
source_region China
Chinese Cyberattacks in Latin America In July 2025, ESET researchers observed FamousSparrow pivot to exclusively targeting government organizations in Latin America.
attribution ESET
Chinese Cyberattacks in Latin America In July 2025, ESET researchers observed FamousSparrow pivot to exclusively targeting government organizations in Latin America.
attribution FamousSparrow
Chinese Cyberattacks in Latin America In July 2025, ESET researchers observed FamousSparrow pivot to exclusively targeting government organizations in Latin America.
‎August 2025
Threat actors using the SparroWocky backdoor have been targeting government organizations across Latin America since August 2025.
target_region United States
Since August 2025, SparroWocky has been spotted almost exclusively attacking government organizations in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela, plus a telecommunications organization in Puerto Rico; likely to keep tabs on how countries are interacting with the US.
target_region Peru
Since August 2025, SparroWocky has been spotted almost exclusively attacking government organizations in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela, plus a telecommunications organization in Puerto Rico; likely to keep tabs on how countries are interacting with the US.
target_region Argentina
Since August 2025, SparroWocky has been spotted almost exclusively attacking government organizations in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela, plus a telecommunications organization in Puerto Rico; likely to keep tabs on how countries are interacting with the US.
target_region Ecuador
Since August 2025, SparroWocky has been spotted almost exclusively attacking government organizations in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela, plus a telecommunications organization in Puerto Rico; likely to keep tabs on how countries are interacting with the US.
target_region Guatemala
Since August 2025, SparroWocky has been spotted almost exclusively attacking government organizations in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela, plus a telecommunications organization in Puerto Rico; likely to keep tabs on how countries are interacting with the US.
target_region Honduras
Since August 2025, SparroWocky has been spotted almost exclusively attacking government organizations in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela, plus a telecommunications organization in Puerto Rico; likely to keep tabs on how countries are interacting with the US.
target_region Panama
Since August 2025, SparroWocky has been spotted almost exclusively attacking government organizations in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela, plus a telecommunications organization in Puerto Rico; likely to keep tabs on how countries are interacting with the US.
target_region Puerto Rico
Since August 2025, SparroWocky has been spotted almost exclusively attacking government organizations in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela, plus a telecommunications organization in Puerto Rico; likely to keep tabs on how countries are interacting with the US.
target_region Venezuela, Bolivarian Republic of
Since August 2025, SparroWocky has been spotted almost exclusively attacking government organizations in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela, plus a telecommunications organization in Puerto Rico; likely to keep tabs on how countries are interacting with the US.
industry Government
Since August 2025, SparroWocky has been spotted almost exclusively attacking government organizations in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela, plus a telecommunications organization in Puerto Rico; likely to keep tabs on how countries are interacting with the US.
industry Telecommunications
Since August 2025, SparroWocky has been spotted almost exclusively attacking government organizations in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela, plus a telecommunications organization in Puerto Rico; likely to keep tabs on how countries are interacting with the US.
‎the summer of 2025
Threat actors aligned with China deployed a custom backdoor called "SparroWocky" to monitor government agencies in Latin America.
target_region China
Since the summer of 2025, it has been using a custom backdoor called "SparroWocky" to keep an eye on government agencies in the Latin American region, particularly those that host Chinese investments that are currently being scrutinized by the Trump administration.
industry Government
Since the summer of 2025, it has been using a custom backdoor called "SparroWocky" to keep an eye on government agencies in the Latin American region, particularly those that host Chinese investments that are currently being scrutinized by the Trump administration.
‎early 2025
Threat actors aligned with China deployed the SparroWocky backdoor across Latin America as FamousSparrow's concession was challenged by the Panamanian government in early 2025.
target_region Panama
As the concession granted to this company was legally challenged by the Panamanian government in early 2025, it seems highly likely that FamousSparrow's operation was intended to gain early, privileged knowledge of local authorities' intentions on this issue."
industry Government
As the concession granted to this company was legally challenged by the Panamanian government in early 2025, it seems highly likely that FamousSparrow's operation was intended to gain early, privileged knowledge of local authorities' intentions on this issue."
‎2026/09/10
Threat actors aligned with China deployed the SparroWocky backdoor across Latin America.
target_region China
Trump has since flagged the activity as an economic risk, and just last week enlisted his Secretary of State to discuss Chinese influence with Peru's president.
target_region Peru
Trump has since flagged the activity as an economic risk, and just last week enlisted his Secretary of State to discuss Chinese influence with Peru's president.
organisation Trump
Trump has since flagged the activity as an economic risk, and just last week enlisted his Secretary of State to discuss Chinese influence with Peru's president.
‎2026/09/17
FamousSparrow, a seven-year-old Chinese cyber-espionage group associated with Earth Estries and Salt Typhoon, has deployed the SparroWocky backdoor across Latin America.
organisation FamousSparrow APT Spies
China's FamousSparrow APT Spies on US Politics in Latin America.
organisation US Politics
China's FamousSparrow APT Spies on US Politics in Latin America.
organisation EU
Related: Russian Hackers Phish EU Officials Over Messaging Apps Replacing the Soviet Union and then Russia as the State's main geopolitical adversary, the Chinese Communist Party (CCP) extended its Belt and Road Initiative to Latin America in 2018, helping to build infrastructure across the region — and with it, its sphere of influence.
organisation State
Related: Russian Hackers Phish EU Officials Over Messaging Apps Replacing the Soviet Union and then Russia as the State's main geopolitical adversary, the Chinese Communist Party (CCP) extended its Belt and Road Initiative to Latin America in 2018, helping to build infrastructure across the region — and with it, its sphere of influence.
organisation the Chinese Communist Party
Related: Russian Hackers Phish EU Officials Over Messaging Apps Replacing the Soviet Union and then Russia as the State's main geopolitical adversary, the Chinese Communist Party (CCP) extended its Belt and Road Initiative to Latin America in 2018, helping to build infrastructure across the region — and with it, its sphere of influence.
organisation CCP
Related: Russian Hackers Phish EU Officials Over Messaging Apps Replacing the Soviet Union and then Russia as the State's main geopolitical adversary, the Chinese Communist Party (CCP) extended its Belt and Road Initiative to Latin America in 2018, helping to build infrastructure across the region — and with it, its sphere of influence.
organisation Philippines Nuclear Agency
Old, Unpatched Flaws Give Attackers Access to Philippines Nuclear Agency Another helpful feature of the modular SparroWocky is its ability to incorporate Beacon Object Files (BOFs) — a file format first introduced by Cobalt Strike, which has since been adopted by other penetration testing developers.
organisation Beacon Object Files
Old, Unpatched Flaws Give Attackers Access to Philippines Nuclear Agency Another helpful feature of the modular SparroWocky is its ability to incorporate Beacon Object Files (BOFs) — a file format first introduced by Cobalt Strike, which has since been adopted by other penetration testing developers.
organisation Media & Automotive
Related: Cyber Op Targets South Korean Media & Automotive Sectors APTs commonly iterate on their flagship spying tools, developing newer and more powerful versions as their ambitions grow, or their targets wise up.
organisation APT
The advanced persistent threat (APT) is associated with, but not definitively confirmed to be related to, Earth Estries and Salt Typhoon ; it's a seven-year-old outfit that made its reputation by attacking international hotels, and governments and corporations here and there.
organisation Earth Estries
The advanced persistent threat (APT) is associated with, but not definitively confirmed to be related to, Earth Estries and Salt Typhoon ; it's a seven-year-old outfit that made its reputation by attacking international hotels, and governments and corporations here and there.
threat_actor Salt Typhoon
The advanced persistent threat (APT) is associated with, but not definitively confirmed to be related to, Earth Estries and Salt Typhoon ; it's a seven-year-old outfit that made its reputation by attacking international hotels, and governments and corporations here and there.
organisation SparroWocky
To meet its new challenge, the following month, it ditched its namesake "SparrowDoor" backdoor for the aforementioned SparroWocky malware.
organisation FamousSparrow
FamousSparrow took the harder route with SparroWocky, utilizing some of the same logic as its past malware, but largely building something new from the ground up.
organisation ESET
Alexandre Côté Cyr, malware researcher at ESET, speculates that SparrowDoor was aging, widely cloned, and possibly triggering cybersecurity alerts too readily.
organisation DLL
The threat actors' new toy is a modular C++ program, deployed via dynamic link library (DLL) sideloading.
organisation OSS
" Not only does BOF compatibility afford FamousSparrow more open source (OSS) red teaming tools to play with, but by folding those tools into their malware framework, they can keep them more hidden than they otherwise could by deploying OSS tools in addition to their malware.
Intelligence Sources
Dark Reading 2026-09-17
AlienVault OTX 2026-09-17