Chinese‑linked hackers deploy new “SparroWocky” backdoor against Latin American governments

Security researchers have uncovered a new backdoor, dubbed "SparroWocky," that appears to be employed by a hacking group with ties to China to infiltrate government networks throughout Latin America.

The tool is a multi‑stage implant that first gains a foothold through spear‑phishing emails or compromised software updates, then establishes a covert command‑and‑control channel. Once installed, it can exfiltrate documents, capture login credentials and execute arbitrary code, giving operators persistent access to sensitive systems.

Chinese‑linked cyber actors have a documented history of targeting the region, ranging from attacks on telecommunications infrastructure to interference in electoral processes. The emergence of "SparroWocky" follows a pattern of expanding influence by exploiting the relatively limited cyber‑security resources of many Latin American ministries.

According to the initial report, agencies in at least four countries—including ministries of interior, finance and health—have detected anomalous network traffic consistent with the new backdoor. While no public breach of classified data has been confirmed, officials are treating the incidents as serious security alerts.

National cyber‑security teams are collaborating with international partners to contain the threat, issuing advisories to patch vulnerable software and to tighten email filtering. Some governments have launched forensic investigations to identify compromised accounts and to remove the implant from affected servers.

Analysts caution that "SparroWocky" may be a prototype that will be refined and redeployed, potentially widening the attack surface across the continent. The episode underscores the need for coordinated regional cyber‑defence strategies and for sustained investment in detection capabilities.