Researchers at ESET have documented a new modular backdoor named SparroWocky deployed by a China-linked espionage group against government agencies and other high-profile organizations across Central and South America since at least August 2025. The malware, attributed to the group known as FamousSparrow or Salt Typhoon, represents a shift in targeting strategy toward Latin America, with 90 percent of related activity occurring in the region between mid-2025 and 2026.

The group, previously focused on telecommunications infrastructure and government agencies globally since at least 2019, began concentrating efforts on Latin American targets following what researchers describe as heightened U.S. policy activity in the region under the Trump administration. ESET researchers Alexandre Côté Cyr and Romain Dumont noted that China's increased surveillance appears aimed at monitoring how local governments respond to U.S. diplomatic and economic pressures, particularly in energy, mining, and telecommunications sectors.

SparroWocky is written in C++ and incorporates open-source components including Mbed TLS for encrypted communications, MinHook for API hooking, and a variant of the SilentMoonwalk technique to evade detection. The malware uses a custom API-hashing algorithm and employs DLL side-loading through a trident loader architecture consisting of a legitimate executable, malicious DLL, and encrypted payload file. After establishing TLS-encrypted connections to command-and-control servers on port 443 (with occasional use of port 8080), the backdoor receives approximately 30 commands for system reconnaissance, file manipulation, screenshot capture, and session management.

The malware's evasion techniques include call stack obfuscation via MinHook routines and dynamic resolution of Windows API functions. ESET has published full indicators of compromise and malware samples on its GitHub repository for further technical analysis.