Chinese‑linked APT swaps SparrowDoor for new SparroWocky backdoor in Latin American espionage campaign

Security researchers have identified a fresh phase in the long‑running cyber‑espionage operations of the China‑aligned group known as FamousSparrow. The team has retired its earlier implant, SparrowDoor, and deployed a modular C++ backdoor dubbed SparroWocky, targeting government networks throughout Latin America.

ESET’s technical analysis indicates that SparroWocky is built for flexibility, allowing operators to load additional modules on demand and to adapt its behavior to the specific environment of each compromised system. The code’s use of native C++ libraries, rather than the interpreted languages common in earlier versions, suggests an effort to evade detection tools that rely on signature‑based heuristics.

The shift follows a pattern of incremental upgrades observed in other state‑sponsored threat actors, where new payloads are introduced to bypass hardened defenses after previous tools become known. By replacing SparrowDoor, FamousSparrow aims to sustain access to diplomatic, intelligence and administrative ministries that have been repeatedly compromised in recent years.

Latin American officials have expressed concern over the persistence of such campaigns, noting that the region’s growing digital interconnectivity makes government agencies attractive targets for foreign intelligence services. While no official comment has been issued by the affected ministries, the disclosure aligns with broader warnings from regional cyber‑security agencies about increased activity from foreign APT groups.

Analysts caution that the emergence of SparroWocky may prompt a wave of defensive updates across the sector. Security vendors are expected to release detection signatures and mitigation guidance, while affected nations may consider diplomatic channels to address the underlying geopolitical motives. The evolution of FamousSparrow’s toolkit underscores the ongoing challenge of protecting state infrastructure from sophisticated, state‑backed cyber actors.