Chinese-Linked Hacker Group Deploys New C++ Backdoor Across Latin America

A cyber‑espionage group identified as FamousSparrow, which is believed to operate under Chinese state direction, has been observed installing a previously unknown backdoor called SparroWocky in networks throughout Latin America since at least August 2025.

Security analysts describe SparroWocky as a modular backdoor written in C++. Its architecture allows operators to load additional payloads, move laterally within compromised environments, and exfiltrate data while evading many traditional detection tools. The modularity also means the same core code can be adapted for a range of targets, from government agencies to private enterprises.

Investigations by several regional CERT teams have uncovered indicators of compromise in multiple countries, suggesting a coordinated campaign rather than isolated incidents. While the exact victims have not been disclosed, the pattern of infection points to high‑value sectors such as public administration, telecommunications and critical infrastructure, which are common focus areas for nation‑state actors seeking strategic intelligence.

The emergence of SparroWocky aligns with a broader trend of Chinese‑aligned threat groups expanding their operations into Latin America, a region that has become increasingly attractive due to its growing digital economies and perceived gaps in cyber defenses. Analysts note that the geopolitical importance of the area, combined with its proximity to major trade routes, makes it a logical extension of existing espionage objectives.

Cybersecurity firms and governmental agencies are now urging organizations in the region to prioritize threat‑hunting initiatives, update intrusion detection signatures, and enforce strict patch management practices. Ongoing monitoring by international threat‑intel communities aims to map the full scope of the campaign and develop countermeasures before the backdoor can be leveraged for more extensive data collection or disruptive activities.