China-Aligned FamousSparrow Deploys SparroWocky Backdoor Across Latin America

FamousSparrow, a China-aligned state-sponsored threat actor, has been using a new backdoor called SparroWocky in attacks on Latin American countries since at least August 2025. The SparroWocky backdoor is modular and written in C++. It has been deployed in multiple countries in the region. ESET security researchers have shared a technical report on the backdoor, providing details on its functionality. The report was authored by Alexandre Côté Cyr and Romain Dumont. The discovery of SparroWocky highlights the ongoing activities of FamousSparrow in the region.