FamousSparrow, a China-linked espionage group, has been using SparroWocky, a sophisticated modular backdoor written in C++, in attacks against government entities across Latin America. SparroWocky replaces the previously used SparrowDoor backdoor and incorporates code from open-source projects. It employs multiple evasion techniques such as manipulating memory structures, runtime code patching, call stack and threat origin spoofing, dynamic API resolving, and disguising malicious threads as legitimate Windows functions via MinHook. The malware is deployed through DLL side-loading after decrypting an RC4-encoded payload mapped directly into memory. Its capabilities include executing commands and files, loading Beacon Object Files in memory, collecting detailed system and network information, enumerating files and user sessions, performing file operations, capturing frequent screenshots with differential transmission, creating processes in other user sessions, acting as a TCP proxy, and self-removal of persistence and files. Persistence is established via a Windows service named ProcAuditManager or registry keys named SnapCart under HKLM or HKCU. ESET researchers identified at least 18 command-and-control servers used by SparroWocky, communicating over ports 443 and 8080 or through HTTP and SOCKS5 proxies. The malware's architecture and evasion techniques indicate a high level of expertise consistent with a well-resourced threat actor. The primary targets are government organizations in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela, with the objective of intelligence gathering related to geopolitical economic pressures.

SparroWocky enables extensive espionage capabilities including system reconnaissance, command execution, file manipulation, screenshot capture, process creation in other user sessions, and network proxying. Its advanced evasion and persistence mechanisms make detection and removal difficult. The malware's presence in government organizations in Latin America facilitates intelligence collection on sensitive geopolitical matters, potentially compromising national security and diplomatic strategies. The modular nature and use of in-memory execution techniques increase the risk of stealthy, persistent access by the threat actor.

No official patch or remediation is indicated for this malware as it is a threat actor tool rather than a software vulnerability. Mitigation should focus on detection and response using updated threat intelligence, including indicators of compromise (IoCs) provided by ESET. Organizations should monitor for DLL side-loading attempts, suspicious Windows service or registry key creation (ProcAuditManager, SnapCart), and anomalous network traffic to known C2 servers over ports 443 and 8080 or via HTTP/SOCKS5 proxies. Endpoint detection solutions should be tuned to detect the evasion techniques described, such as thread creation hooking and runtime code patching. Incident response plans should be prepared for potential compromise scenarios involving this malware.