China-linked hackers have deployed the new SparroWocky malware against government organisations across Latin America. Researchers believe the group wants intelligence about regional responses to growing US pressure on Chinese economic interests.
FamousSparrow Targets Latin American Governments
The China-linked espionage group FamousSparrow has launched attacks against government organisations in several Latin American countries.
Security researchers at ESET detected activity in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico and Venezuela. The campaign has continued for more than a year.
Since mid-2025, the group has focused primarily on Latin American targets. Moreover, ESET believes the attackers aim to monitor how governments respond to US pressure on Chinese economic interests.
FamousSparrow previously relied on a custom backdoor called SparrowDoor. However, the group has now replaced it with the more advanced SparroWocky malware.
SparroWocky Offers Extensive Espionage Capabilities
SparroWocky is a modular C++ backdoor that incorporates code from several open-source projects. Once active, it gives attackers extensive control over a compromised Windows system.
For example, the malware can execute commands and launch programs. It can also load Beacon Object Files directly into memory.
In addition, SparroWocky gathers detailed information about the computer, network, user, domain and Windows version. It can examine drives, folders, files, connected displays and active user sessions.
The malware also allows attackers to upload, download, copy, move, rename or delete files. Therefore, operators can both steal information and modify data on the infected device.
Furthermore, SparroWocky can capture screenshots every 500 milliseconds. After sending the first complete image, it transmits only the areas that change. This approach reduces network traffic while allowing attackers to monitor activity almost continuously.
The backdoor can also create processes inside another logged-in user’s session. Meanwhile, its proxy features allow it to forward connections and operate as a TCP proxy.
Finally, the malware can remove its persistence mechanisms and delete its own files. Attackers can consequently erase parts of their presence when they finish an operation.
Hackers Load the Malware Directly Into Memory
FamousSparrow deploys SparroWocky through DLL side-loading. This technique tricks a legitimate application into loading a malicious library.
First, a loader decrypts an RC4-encoded payload stored inside a DAT file. It then maps the payload directly into memory instead of writing the complete malware to disk.
As a result, the attack leaves fewer obvious traces for security software to detect. The malware also resolves application programming interfaces dynamically and disguises malicious code as legitimate Windows components.
Additionally, SparroWocky uses call-stack spoofing and threat-origin spoofing. These methods make malicious activity appear to come from trusted code or processes.
Backdoor Conceals Malicious Threads
SparroWocky manipulates the Windows thread-creation process to hide its activity from security products.
The malware uses the MinHook library to intercept the CreateThread function. It then replaces the original thread starting address with AnimateWindow, a legitimate Windows function.
Consequently, security software may classify the new thread as harmless. The real malicious starting point remains concealed from tools that rely on this information during analysis.
SparroWocky also manipulates low-level memory structures and patches code while running. According to ESET, these techniques demonstrate extensive knowledge of Windows internals and malware analysis methods.
The level of technical sophistication supports the assessment that FamousSparrow has significant resources and experience.
SparroWocky Creates Multiple Persistence Options
The backdoor can maintain access through either a Windows service or a registry entry. Its chosen method depends on the privileges available on the compromised system.
When possible, SparroWocky creates a Windows service named ProcAuditManager. Alternatively, it adds a registry key called SnapCart under either HKLM or HKCU.
These options allow the malware to restart after the computer reboots or the user logs in again. Therefore, FamousSparrow can maintain long-term access to valuable government systems.
Researchers Identify 18 Control Servers
During their investigation, ESET researchers identified at least 18 command-and-control addresses linked to the campaign.
SparroWocky communicates with this infrastructure over ports 443 and 8080. It can connect directly or route its traffic through HTTP and SOCKS5 proxies.
These flexible communication methods help the attackers operate across different network environments. They can also make malicious traffic more difficult to distinguish from legitimate activity.
ESET has published technical details and indicators of compromise connected to the attacks. These findings can help organisations identify SparroWocky malware infections and investigate suspicious activity within their networks.
0 responses to “Chinese Hackers Target Governments With SparroWocky Malware”