Full Report
Beware the SparroWocky, my son! The backdoor that bites…
Analysis Summary
# Threat Actor: Salt Typhoon
## Attribution & Identity
* **Actor Identification:** Salt Typhoon (also known as FamousSparrow).
* **Aliases:** FamousSparrow.
* **Known Associations:** A PRC-backed (People’s Republic of China) state-sponsored espionage group.
* **Background:** The group is known for long-term stealthy access to telecommunications and government organizations dating back to 2019.
## Activity Summary
* **Recent Campaigns:** Since August 2025 and continuing into 2026, the group has executed a major campaign focused on Central and South America. Approximately 90% of their recent targets are located in this region.
* **Primary Operation:** Deployment of a new, modular C++ backdoor dubbed "SparroWocky" to monitor local government reactions to shifting U.S. geopolitical influences.
## Tactics, Techniques & Procedures
* **Trident Loader Scheme:** Utilizes a three-part execution chain: a legitimate executable, a malicious DLL, and a file containing encrypted malware.
* **DLL Side-Loading:** The loader is executed via malicious DLL side-loading to bypass security controls.
* **Evasion Techniques:**
* Uses **MinHook** library to hide thread start addresses from security products.
* Incorporates a variant of **SilentMoonwalk** to spoof call stacks.
* Custom API-hashing algorithm to dynamically resolve Windows API functions.
* **In-Memory Execution:** Uses **COFF Loader** to dynamically load and execute plugins in-memory as Common Object File Format (COFF) objects.
* **MITRE ATT&CK IDs:**
* T1574.002 (DLL Side-Loading)
* T1027 (Obfuscated Files or Information - API Hashing)
* T1055 (Process Injection - In-memory loading)
* T1113 (Screen Capture)
* T1071.001 (Web Protocols - TLS/HTTP)
## Targeting
* **Sectors:** Government agencies, energy, mining, and telecommunications.
* **Geography:** Central and South America (Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela).
* **Victims:** High-profile government organizations in the aforementioned regions.
## Tools & Infrastructure
* **Malware Families:**
* **SparroWocky:** A custom modular C++ backdoor containing references to Lewis Carroll’s poem "Jabberwocky."
* **Open Source Integration:** Mbed TLS (secure communication), MinHook (API hooking), COFF Loader (in-memory execution), and SilentMoonwalk (call stack spoofing).
* **Infrastructure:**
* Direct IP connections for C2 (Command & Control).
* Communication via TLS over ports 443 and 8080.
* *Note: Specific IPs and domains were referenced as being available in the ESET GitHub repository (github[.]com/eset/malware-ioc/tree/master/famoussparrow/).*
## Implications
Salt Typhoon’s strategic pivot to Latin America suggests a direct intelligence-gathering response to U.S. foreign policy shifts (specifically under the second Trump administration). The group's focus on energy, mining, and telecoms indicates a dual objective: protecting Chinese economic investments and monitoring the diplomatic positioning of regional governments. The technical sophistication of the SparroWocky backdoor demonstrates an increased emphasis on anti-forensics and evasion to maintain long-term persistence.
## Mitigations
* **DLL Side-Loading Defense:** Implement strict application control policies (e.g., AppLocker or Windows Defender Application Control) to prevent the execution of unsigned or untrusted DLLs.
* **Memory Monitoring:** Utilize EDR (Endpoint Detection and Response) tools capable of detecting API hooking and anomalous call stack patterns associated with the SilentMoonwalk technique.
* **Network Inspection:** Monitor for unusual outbound TLS traffic to direct IP addresses (rather than hostnames) on ports 443 and 8080.
* **System Hardening:** Regularly audit and monitor for the creation of new services or persistence mechanisms, specifically those involving the `WTSEnumerateSessionsW` function call.