ESET researchers have caught the China-aligned threat actor FamousSparrow deploying a previously undocumented backdoor called SparroWocky against government targets across Latin America, with activity dating back to at least August 2025. Confirmed targets span Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela, and researchers tie the regional focus to Washington’s renewed political attention on Chinese influence in the region.
A quiet, modular backdoor with an odd signature
SparroWocky is a modular C++ backdoor delivered through DLL sideloading: a legitimate, signed executable loads a malicious loader DLL, which decrypts and launches the real payload. That is a well-worn technique specifically because it lets the malicious code inherit the trust of a binary that endpoint security already allows to run. Once active, SparroWocky supports command execution and file exfiltration against the compromised host.
The detail that stands out is almost decorative: early versions of the malware embed the first stanza of Jabberwocky, Lewis Carroll’s nonsense poem, inside the code. It changes nothing about the malware’s capability, but it is a useful reminder that attribution research leans on exactly these kinds of idiosyncratic fingerprints as much as it leans on infrastructure overlap or code reuse.
What to do now
- DLL sideloading abuses trust in signed binaries your own allowlisting may already grant. An assumed-breach assessment tests whether that trust actually holds once a legitimate-looking executable is already running somewhere it should not be.
- Government and public-sector entities in the region named in this campaign, and any organisation with similar geopolitical exposure, should treat this as a live threat model rather than a foreign news item. Red team operations built around a specific adversary’s known tradecraft, sideloading chains included, tell you what your current detection stack would actually catch.
- Hunt for unexpected loader DLLs sitting alongside legitimate signed executables, and for outbound connections initiated by processes that have no normal reason to reach the internet.
The takeaway
State-aligned actors are not chasing the flashiest exploit here. They are chasing quiet persistence through a technique that has worked for years, aimed at a region that has historically had less scrutiny than the usual APT targets. That combination, unglamorous method plus underwatched target, is exactly the profile that stays undetected the longest.