Chinese cyberespionage group FamousSparrow is under the microscope of security researchers as it uses a new and highly sophisticated backdoor called SparroWocky . According to ESET , the malware has been used against government organizations in several Latin American countries , in operations that appear to have been ongoing for more than a year.
The new tool replaces SparrowDoor ,a previous custom backdoor associated with the same group. This change shows that FamousSparrow continues to evolve its infrastructure and tools, adapting its techniques to the needs of each business.
Government agencies in eight countries targeted
ESET's telemetry and research revealed traces of SparroWocky in organizations in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela.
The geographic concentration of attacks is an important element in understanding this particular campaign. Researchers believe that FamousSparrow's interest is related to gathering information about how governments in the region are responding to increasing pressure from the United States regarding Chinese economic interests.
This is, therefore, an activity that appears to have a strong espionage and informational nature, with the focus being on gaining access and collecting data from targeted organizations.
See also: N0va Phishkit targets businesses in the US and EU
A multi-tool written in C++
ESET's technical analysis shows that SparroWocky is a modular backdoor written in C++, incorporating code from open source projects. Its modular architecture allows the malware to have a wide range of capabilities and adapt to the target.
Among other things, it can execute commands and executable files, load and execute Beacon Object Files directly into memory, and collect information about the operating system, user, network, domain, and Windows version.
It can also list disks, folders, files, screens, and active user sessions, and can transfer files to and from the compromised system. These operations include uploading, downloading, copying, moving, renaming, and deleting files.
Monitor the screen in near real time
One of the most interesting features of SparroWocky is that it takes screenshots every 500 milliseconds. However, the malware does not need to transmit the entire image each time.
After the first full download, it only transfers the parts of the screen that have changed. This approach can limit the amount of data sent to the attackers' infrastructure, while also allowing for continuous monitoring of a user's activity.
The backdoor can even create processes within the session of another logged-in user and act as a TCP proxy, forwarding connections through the compromised system.
DLL side-loading and hidden payload
SparroWocky's development relies on techniques designed to make it difficult to detect. According to ESET, a loader decrypts the payload, which is stored in a .dat file and encoded with RC4, and then maps it directly into memory.
See also: CHOSEN BRICK: The malware used by Iranian hackers for espionage
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
This process is combined with DLL side-loading, a technique in which the malicious DLL is loaded via a legitimate application or process. The use of legitimate operating system components can make it difficult for security systems to distinguish malicious activity from normal Windows operation.
Malware tries to "trick" security tools
SparroWocky has additional anti-analysis and anti-detection mechanisms. These include dynamic API resolving, DLL and malicious code hiding in memory, as well as threat origin and call stack spoofing.
Of particular interest is the way it interferes with Windows thread creation. ESET says the malware uses the MinHook to hook into the CreateThread. The goal is to hide the actual start address of a thread from security products.
Instead of the actual malicious address, SparroWocky uses AnimateWindow, a legitimate Windows function, as its start address. So a security tool that superficially examines the process may see something that looks perfectly legitimate.
Persistence and trace deletion mechanisms
To maintain access to the system, the malware can install itself as a Windows service called ProcAuditManager or create a specific registry key called SnapCart. The choice depends on the available permissions in the compromised environment.
At the same time, SparroWocky can disable the persistence mechanism and delete its own files, which can significantly complicate forensic analysis after an attack.
ESET believes that this architecture, combined with anti-analysis techniques, indicates significant knowledge of Windows internals and experience in developing tools designed to evade detection.
At least 18 C2 infrastructures
During their investigation, the analysts identified at least 18 command-and-control (C2) addresses that communicated directly with SparroWocky. The communication was done via ports 443 and 8080, as well as via HTTP and SOCKS5 proxies.
See also: KREMLIN malware: Malicious extension steals banking sessions
Having multiple C2 infrastructures can offer attackers greater flexibility and resilience, as disrupting or blocking a single address is not necessarily enough to stop malware communication.
FamousSparrow expands its presence
ESET data shows that FamousSparrow has focused a significant portion of its activity on targets in Latin America since mid- 2025 . The use of a new backdoor , with extensive information collection capabilities and strong obfuscation mechanisms, demonstrates the continued evolution of this threat.
For organizations that may be targeted, the case highlights the importance of monitoring process behavior, checking for unusual DLL loads, analyzing network connections, and protecting endpoint systems. The threat intelligence data and indicators of compromise (IoCs) published by ESET are also of particular value, as they can be used to identify relevant activity in existing environments.
The SparroWocky case shows once again that modern cyberespionage operations do not necessarily rely on a static malicious file. Instead, they leverage flexible, modular tools, obfuscation techniques, and multiple layers of infrastructure, aiming to remain undetected for as long as possible.
source: www.bleepingcomputer.com
