/
← Voltar ao feed
high government

FamousSparrow deploys new SparroWocky backdoor against Latin American governments, replacing SparrowDoor

1 fonte(s) · 1 atualização(ões) · publicado 17/09/2026 05:50 · coletado há 3 dias

ESET Research reports that the China-aligned APT group FamousSparrow has been using a new modular C++ backdoor, SparroWocky, since at least August 2025. The backdoor has replaced SparrowDoor as the group's main implant. From mid-2025 into 2026, about 90% of the group's targets in ESET telemetry were in Latin America, mostly governmental entities in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico and Venezuela. ESET assesses with high confidence that the activity is FamousSparrow's, because SparrowDoor (used only by this group) deployed SparroWocky in early attacks and the same organizations were targeted with both. ESET suspects the focus reflects China's response to increased US activity in the region. One Panamanian target is tied to the dispute over two canal-area ports formerly operated by a China-based company.

Detalhes técnicos

  • Loader: a trident scheme of a legitimate executable, a patched malicious DLL loaded via DLL side-loading, and an RC4-encrypted .dat payload file. The file has a header with magic value 0x11328712 and a 16-byte RC4 key. The payload is a PE with the MZ/PE magic values removed and is reflectively mapped in memory.
  • Capabilities: command execution, arbitrary file execution, TCP proxy, system information collection, file exfiltration, periodic screenshots, self-deletion (command 0x13) and loading of Beacon Object Files (command 0x14) via a modified COFF Loader.
  • Persistence: a dedicated service or a registry Run key, depending on configuration. An instance-synchronization mechanism uses the mutex, event and shared-memory objects MyMutexName, MyEventName and MySharedMemName.
  • Evasion: SilentMoonwalk-style call-stack spoofing, custom API hashing, MinHook hooking of CreateThread to hide thread start addresses (AnimateWindow), and a custom PE loader that forges LDR_DATA_TABLE_ENTRY entries and uses MUI-based host-process camouflage.
  • C2: TLS via Mbed TLS (DRBG personalization string acdbenus), with RC4-encrypted command data. Connection modes are direct/system proxy, HTTP proxy (Negotiate/Basic, User-Agent Mozilla/5.0) and SOCKS5. C2 servers are addressed by IP, usually on port 443 and sometimes 8080. The session-ready marker is 0x11223344.
  • Sample: compiled 2025-11-17, SHA-1 44F0A22B143B79FA760BF31E14C8FFF714C8A2A1, version 1.8.
  • Attribution: FamousSparrow is linked by Trend Micro to Earth Estries, but ESET tracks it separately from Salt Typhoon.

Remediação

The article points to ESET's GitHub repository for the full IoC list, samples and a payload-decryption script. Defenders should hunt for DLL side-loading with patched legitimate DLLs and companion .dat files, and for in-memory implants that spoof call stacks.

Linha do tempo

  1. welivesecurity.com ↗ · pub. 17/09/2026 05:50 · coletado 19/10 18:00 primeiro registro

    FamousSparrow deploys new SparroWocky backdoor against Latin American governments, replacing SparrowDoor

    ler a análise desta fonte

    ESET Research reports that the China-aligned APT group FamousSparrow has been using a new modular C++ backdoor, SparroWocky, since at least August 2025. The backdoor has replaced SparrowDoor as the group's main implant. From mid-2025 into 2026, about 90% of the group's targets in ESET telemetry were in Latin America, mostly governmental entities in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico and Venezuela. ESET assesses with high confidence that the activity is FamousSparrow's, because SparrowDoor (used only by this group) deployed SparroWocky in early attacks and the same organizations were targeted with both. ESET suspects the focus reflects China's response to increased US activity in the region. One Panamanian target is tied to the dispute over two canal-area ports formerly operated by a China-based company.

    Technical Details

    • Loader: a trident scheme of a legitimate executable, a patched malicious DLL loaded via DLL side-loading, and an RC4-encrypted .dat payload file. The file has a header with magic value 0x11328712 and a 16-byte RC4 key. The payload is a PE with the MZ/PE magic values removed and is reflectively mapped in memory.
    • Capabilities: command execution, arbitrary file execution, TCP proxy, system information collection, file exfiltration, periodic screenshots, self-deletion (command 0x13) and loading of Beacon Object Files (command 0x14) via a modified COFF Loader.
    • Persistence: a dedicated service or a registry Run key, depending on configuration. An instance-synchronization mechanism uses the mutex, event and shared-memory objects MyMutexName, MyEventName and MySharedMemName.
    • Evasion: SilentMoonwalk-style call-stack spoofing, custom API hashing, MinHook hooking of CreateThread to hide thread start addresses (AnimateWindow), and a custom PE loader that forges LDR_DATA_TABLE_ENTRY entries and uses MUI-based host-process camouflage.
    • C2: TLS via Mbed TLS (DRBG personalization string acdbenus), with RC4-encrypted command data. Connection modes are direct/system proxy, HTTP proxy (Negotiate/Basic, User-Agent Mozilla/5.0) and SOCKS5. C2 servers are addressed by IP, usually on port 443 and sometimes 8080. The session-ready marker is 0x11223344.
    • Sample: compiled 2025-11-17, SHA-1 44F0A22B143B79FA760BF31E14C8FFF714C8A2A1, version 1.8.
    • Attribution: FamousSparrow is linked by Trend Micro to Earth Estries, but ESET tracks it separately from Salt Typhoon.

    Remediation

    The article points to ESET's GitHub repository for the full IoC list, samples and a payload-decryption script. Defenders should hunt for DLL side-loading with patched legitimate DLLs and companion .dat files, and for in-memory implants that spoof call stacks.