Threats affecting Ecuador

The FamousSparrow espionage group, linked to China, has deployed a new backdoor malware named SparroWocky targeting government organizations in Latin America since mid-2025. SparroWocky is a modular C++ backdoor with advanced anti-analysis and evasion techniques, including DLL side-loading, runtime code patching, and thread creation interception to disguise malicious activity. It enables extensive system reconnaissance, file operations, screenshot capture, process creation, and network proxying. Persistence is maintained via Windows services or registry keys. The malware communicates with multiple command-and-control servers over common ports and proxies. The attacks aim to gather intelligence on Latin American governments' responses to U.S. pressure on Chinese economic interests.

Malware#malware#aptArgentina+7

Two multi-stage network intrusion campaigns are actively targeting organizations in Latin America, specifically in Mexico, Ecuador, and Brazil. The Mexican campaign targets transportation and government entities using living-off-the-land techniques and self-hosted NextChat instances. The Brazilian campaign targets financial organizations with custom remote access trojans (RATs) and tunneling tools, including a Go-based SOCKS5 proxy. Both campaigns leverage AI tools such as Claude and GPT-4.1 to generate scripts and troubleshoot operations. Operational security failures by attackers, including exposed staging directories and unsecured interfaces, have allowed defenders visibility into their activities. Indicators include multiple duckdns.org domains, an IP address, and various file hashes. There are no known exploits in the wild or confirmed active threat actors at this time.

Campaign#phishing campaign#socktzBrazil+2

UAT-9244, a China-nexus advanced persistent threat actor, has been targeting critical telecommunications infrastructure in South America since 2024. The group employs three new malware implants: TernDoor, a Windows-based backdoor variant of CrowDoor; PeerTime, an ELF-based backdoor using BitTorrent protocol; and BruteEntry, a brute force scanner for SSH, Postgres, and Tomcat servers. UAT-9244 uses dynamic-link library side-loading, scheduled tasks, and registry modifications for persistence. The group is closely associated with FamousSparrow and Tropic Trooper, sharing similar tooling and tactics. Their infrastructure includes multiple command and control servers and operational relay boxes for scanning and brute-forcing activities.

Malware#crowdoor#telecommunicationsBrazil+9