Beware the SparroWock: The backdoor that bites, the commands that catch

SparroWocky is a sophisticated C++ backdoor used by the China-aligned FamousSparrow APT group since August 2025. It targets governmental organizations in Latin America with advanced evasion and modular capabilities. The backdoor uses reflective loading, call stack spoofing, encrypted communications, and host process camouflage to avoid detection. It replaces a previous backdoor called SparrowDoor and incorporates open-source projects within its codebase. The threat actor's focus aligns with geopolitical interests in monitoring Latin American governmental responses to US pressures.

• Lazarus luring employees with trojanized coding challenges: The case of a Spanish aerospace companyMalware2026-09-18
• SilkParasite: Tracking a China-Nexus APT Across Central AsiaMalware2026-08-20
• New Project CAV3RN .NET Native AOT communication moduleMalware2026-07-21
• One Target, Two Flags | Rival Espionage Actors Converge On Pakistani Law EnforcementMalware2026-07-09
• Matryoshka #3/3: Gamaredon's Gammasteel InfostealerMalware2026-06-04