Reported by 4 outlets
Chinese hackers use SparroWocky malware in govt espionage attacks
Why this score
- Breadth
- 2.00 / 2.0 · 4 sources
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 5.00 / 5.0 · CVSS + KEV signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.60 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Desk analysis
FamousSparrow, a China-aligned APT active since at least 2019 and first documented exploiting CVE-2021-26855 (ProxyLogon) in 2021, has replaced its long-running SparrowDoor backdoor with SparroWocky, a modular C++ backdoor first observed in August 2025. The malware uses a trident loader scheme that relies on DLL side-loading via a patched legitimate executable and an encrypted .dat payload file starting with the magic value 0x11328712; the loader decrypts the payload with a 16-byte RC4 key and reflectively maps it without writing to disk. ESET telemetry shows SparroWocky version 1.8 communicating over TLS with C&C server 216.238.110.120 on port 443, using Mbed TLS with the personalization string acdbenus, and establishing persistence either as a service named ProcAuditManager or via a registry Run key named SnapCart.
The campaign is not scattered espionage but a focused operation: since July 2025, roughly 90% of FamousSparrow's observed targets have been in Latin America, with government entities in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela hit by the same backdoor family. That geographic concentration, combined with the malware's ability to act as a TCP proxy, load in-memory Beacon Object Files through a COFF loader derived from open-source tooling, and take screenshots every 500 milliseconds, means successful access turns a government endpoint into a persistent intelligence pipeline rather than a one-time breach. The shift from SparrowDoor to SparroWocky also signals an upgrade in defense evasion, including SilentMoonwalk call-stack spoofing, MinHook-based hiding of thread start addresses, dynamic API hashing, and a self-deletion routine that removes both persistence and payload files with a batch script.
Defenders should hunt for the specific IoC patterns carried by the events: payload .dat files with the 0x11328712 header, service names matching ProcAuditManager, registry values named SnapCart under SOFTWARE\Microsoft\Windows\CurrentVersion\Run, and TLS connections to 216.238.110.120 or related Constant Company infrastructure on port 443. The ESET GitHub repository provides an extraction script (extract_sparrowocky.py) for decrypting payload files; memory hunting should focus on reflective PE mappings without MZ/PE magic values in the header, and on BOF loading via the custom command 0x14. Network restrictions should block outbound TCP to the known C&C ranges (38.54.57.17, 38.60.197.55, 216.238.92.2, 216.238.105.53) documented in the ESET analysis, and endpoint telemetry should alert on DLL side-loading of winfsp-x64.dll and DukeQt.dll loader variants.
Watch for two developments that would shift the assessment: confirmation of active exploitation of CVE-2021-26855 in the current campaign (the group used it for initial access in 2021 and targets outdated Exchange installations), and any new ESET telemetry showing SparroWocky deployment outside Latin America, which would break the 90% regional concentration and suggest the group's geographic mandate is widening rather than remaining tied to US-Latin American geopolitical friction.
Timeline
-
original reporting
Chinese hackers use SparroWocky malware in govt espionage attacks
bleepingcomputer.com · 26d ago · September 17th, 2026
The China-linked espionage group FamousSparrow has been using a new backdoor named SparroWocky in attacks on government organizations in Latin America. The operations have been ongoing for more than a year, with the new malware replacing the previously used SparrowDoor custom backdoor . ESET researchers observed SparroWocky in attacks targeting organizations in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela. The researchers believe the threat actor's objective was to collect intelligence on Latin American governments’ responses to increasing U.S. pressure on Chinese economic interests. FamousSparrow victims Source: ESET ESET's analysis revealed that SparroWocky is a modular, full-blown C++ backdoor that includes code from open-source projects. The malware features anti-analysis mechanisms, like manipulating low-level structures in memory and patching code at runtime. SparroWocky's capabilities include: run commands and executable files load and execute Beacon Object Files in memory collect system, network, user, domain, and Windows-version details enumerate drives, directories, files, displays, and active user sessions upload, download, copy, move, rename, and delete files capture screenshots every 500 milliseconds, transmitting only changed screen regions after the first full-screen image create processes in another logged-in user’s session operate as a TCP proxy and forward connections remove its persistence and delete its own files Accord
-
update from www.welivesecurity.com
#ESETresearch discovered SparroWocky, a new backdoor of the #FamousSparrow APT group. This new malware has quickly replaced SparrowDoor as t
www.welivesecurity.com · 26d ago · September 17th, 2026
ESETresearch discovered SparroWocky, a new backdoor of the #FamousSparrow APT group. This new malware has quickly replaced SparrowDoor as t
via X https://www.welivesecurity.com/en/eset-research/beware-sparrowock-backdoor-bites-commands-catch/
-
update from www.bleepingcomputer.com
Chinese hackers use SparroWocky malware in govt espionage attacks https:// bleepingcomputer.com/news/security/ chinese-hackers-use-sparrowoc
www.bleepingcomputer.com · 26d ago · September 17th, 2026
Chinese hackers use SparroWocky malware in govt espionage attacks https:// bleepingcomputer.com/news/security/ chinese-hackers-use-sparrowoc
via X https://www.bleepingcomputer.com/news/security/chinese-hackers-use-sparrowocky-malware-in-govt-espionage-attacks/
-
update from www.bleepingcomputer.com
SparroWocky: new malware attributed to Chinese actors targeting government entities
www.bleepingcomputer.com · 26d ago · September 17th, 2026
SparroWocky: new malware attributed to Chinese actors targeting government entities. What stands out: the name evokes both SparrowDoor (the predecessor) and Wocky (likely a reference to communication protocols).
-
update from cyberpress.org
FamousSparrow Targets Government Networks Across Eight Latin American Regions With New Backdoor
cyberpress.org · 26d ago · September 17th, 2026
China-aligned cyberespionage group FamousSparrow has expanded attacks against government organizations across eight Latin American regions using a newly discovered custom backdoor named SparroWocky. The campaign began focusing heavily on Latin America from July 2025, with the new malware appearing a month later. According to ESET telemetry, about 90% of FamousSparrow’s observed targets from mid-2025 into 2026 were located in Latin America. This is a notable shift for the group, which had previously targeted organizations across multiple regions and sectors. FamousSparrow is believed to have been active since at least 2019. The group was publicly documented in 2021 after exploiting the Microsoft Exchange ProxyLogon vulnerability, tracked as CVE-2021-26855. It initially targeted hotels but later expanded operations against governments, engineering companies, international organizations, trade groups, and law firms. FamousSparrow Hits Latin Governments The attackers appear to be moving away from their older custom implant, SparrowDoor, in favor of the more advanced SparroWocky backdoor. ESET linked the malware to FamousSparrow with high confidence after observing SparrowDoor deploy SparroWocky in early attacks. Definition of the structure of SparroWocky’s payload file (Source: welivesecurity) SparroWocky is a modular C++ backdoor desi
-
update from gbhackers.com
FamousSparrow Deploys New SparroWocky Backdoor Against Latin American Governments
gbhackers.com · 26d ago · September 17th, 2026
ESET says the malware has been active in the region since at least August 2025, following a sharp shift in the group’s victim targeting that […] The post FamousSparrow Deploys New SparroWocky Backdoor Against Latin American Governments appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
mentioned by www.bleepingcomputer.com
FamousSparrow Targets Latin American Governments With SparroWocky https:// bleepingcomputer.com/news/security/ chinese-hackers-use-sparrowoc
www.bleepingcomputer.com · 26d ago · September 17th, 2026
-
mentioned by www.welivesecurity.com
New. "Our previous public report on FamousSparrow revealed that this China-aligned APT group had developed two new versions of its custom ba
www.welivesecurity.com · 26d ago · September 17th, 2026
-
mentioned by www.bleepingcomputer.com
Chinese hackers use # SparroWocky # malware in govt # espionage attacks https://www. bleepingcomputer.com/news/secu rity/chinese-hackers-use
www.bleepingcomputer.com · 25d ago · September 18th, 2026