FamousSparrow Group Employs SparroWocky Malware in Espionage Campaigns

The China-linked espionage group FamousSparrow has been actively using a new backdoor known as SparroWocky in its operations against government organizations in Latin America. This campaign has been ongoing for over a year, with SparroWocky replacing the earlier SparrowDoor custom backdoor. ESET researchers have identified SparroWocky in attacks directed at various organizations across Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela.

The primary goal of these attacks appears to be the collection of intelligence regarding how Latin American governments are responding to increasing U.S. pressure on Chinese economic interests. ESET's analysis indicates that SparroWocky is a sophisticated C++ backdoor that incorporates code from open-source projects. It is equipped with various anti-analysis mechanisms, including the manipulation of low-level memory structures and runtime code patching.

SparroWocky is deployed through a process known as DLL side-loading, which occurs after a loader decrypts the RC4-encoded payload found in a .dat file and maps it directly into memory to evade detection. The malware employs several evasion techniques, such as call stack and threat origin spoofing, dynamic API resolution, and disguising malicious in-memory code and DLLs as legitimate Windows components.

Evasion Tactics Employed by SparroWocky

To avoid detection by security solutions, SparroWocky intercepts the Windows thread creation process to modify the start address. According to ESET, the malware uses the MinHook library to hook the CreateThread function, concealing the original lpStartAddress parameter from security products. Consequently, any thread initiated by SparroWocky would appear to have AnimateWindow as its starting address, which is likely to be deemed legitimate by security software.

Cleared for Release

The malware establishes persistence through either a Windows service named ProcAuditManager or by creating a Windows registry key called SnapCart, depending on the privileges available. ESET researchers note that the architecture and evasion techniques of SparroWocky demonstrate a strong understanding of anti-analysis tactics and Windows internals, supporting their attribution to a well-resourced and experienced threat group.

During their investigation, ESET identified at least 18 command-and-control (C2) addresses that communicate directly with the malware over ports 443 or 8080, or through HTTP and SOCKS5 proxies. Their telemetry indicates that since mid-2025, FamousSparrow has primarily focused its efforts on targets within the Latin American region. ESET's report includes a detailed technical analysis of the SparroWocky backdoor along with a list of indicators of compromise (IoCs) associated with this malicious activity.