Full Report
ESET researchers document SparroWocky, the new flagship backdoor of the FamousSparrow APT group
Analysis Summary
# Threat Actor: FamousSparrow
## Attribution & Identity
* **Identification:** FamousSparrow is a China-aligned advanced persistent threat (APT) group active since at least 2019.
* **Aliases & Associations:**
* Linked to **Earth Estries** (though the exact nature of the relationship is unclear).
* Publicly linked by some sources to **Salt Typhoon**, though ESET tracks them separately due to a lack of technical indicators.
* **Confidence:** High confidence in attribution for the SparroWocky campaign, as the malware was deployed via the group's exclusive "SparrowDoor" backdoor and targeted the same historical victims.
## Activity Summary
* **Recent Campaigns:** Since July 2025, the group has shifted its primary focus to Latin America. This is theorized to be a strategic reaction to increased US interest in the region.
* **Malware Transition:** In August 2025, the group began deploying **SparroWocky**, a new flagship C++ backdoor. It has largely replaced their previous signature implant, SparrowDoor.
* **Historical Activity:** Historically known for exploiting the **ProxyLogon** vulnerability (CVE-2021-26855) in 2021 and targeting the global hospitality sector.
## Tactics, Techniques & Procedures
* **Core Capabilities:** Modular C++ architecture with advanced knowledge of Windows internals and anti-analysis tricks.
* **Runtime Manipulation:** Patches code at runtime to avoid detection and manipulates low-level memory structures.
* **Execution:** Capability to load and execute **Beacon Object Files (BOFs)**, allowing for extensible red-teaming functionality.
* **Code Sharing:** Recent shift toward incorporating code from open-source projects directly into custom malware.
* **MITRE ATT&CK IDs:**
* **T1059.003:** Command and Scripting Interpreter: Windows Command Shell
* **T1622:** Helper/Debugger Detection (Anti-analysis)
* **T1083:** File and Directory Discovery
* **T1113:** Screen Capture
* **T1573.002:** Encrypted Channel: Asymmetric Cryptography (TLS)
* **T1573.001:** Encrypted Channel: Symmetric Cryptography (RC4)
* **T1090.001/002:** Internal and External Proxying (HTTP/SOCKS5)
## Targeting
* **Sectors:** Primarily governmental organizations and international entities. Historically: Hotels, trade groups, engineering companies, and law firms.
* **Geography:** Heavy concentration (90% of telemetry) on **Latin America**.
* **Victims:** Government entities in:
* Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela.
## Tools & Infrastructure
* **Malware Families:**
* **SparroWocky:** New flagship modular C++ backdoor (contains stanzas from the poem "Jabberwocky").
* **SparrowDoor:** Former signature backdoor used for initial deployment of SparroWocky.
* **Infrastructure:**
* Uses TLS over TCP for Command and Control (C2).
* Supports exfiltration over the C2 channel and proxying via HTTP/SOCKS5.
* (Note: Specific defanged IPs/URLs were not provided in the article excerpt, but the group is known for using compromised servers for C2).
## Implications
FamousSparrow represents a sophisticated tier of China-aligned espionage that is highly adaptable. Their sudden geographical pivot to Latin America suggests their operations are tightly coupled with Chinese geopolitical interests. The transition to SparroWocky—which uses BOFs and runtime patching—demonstrates an evolution toward more stealthy, modular, and industry-standard offensive techniques, making detection more difficult for traditional security solutions.
## Mitigations
* **Vulnerability Management:** Prioritize patching of internet-facing applications, specifically Microsoft Exchange (given the group's history with ProxyLogon).
* **Memory Defense:** Employ EDR solutions capable of detecting runtime memory patching and the execution of Beacon Object Files (BOFs).
* **Network Monitoring:** Inspect TLS traffic for unusual patterns or non-standard application-layer behavior over TCP.
* **Geographic Fencing:** Organizations in Latin America, particularly in the government sector, should increase monitoring for indicators associated with SparrowDoor and SparroWocky.