Threats Tagged 'sparrowocky'

SparroWocky is a sophisticated C++ backdoor used by the China-aligned FamousSparrow APT group since August 2025. It targets governmental organizations in Latin America, replacing the group's previous SparrowDoor backdoor. The malware features advanced evasion techniques such as reflective loading, call stack spoofing (SilentMoonwalk), and encrypted communications using TLS and RC4. It also incorporates open-source projects and uses modular components including Beacon Object Files. The backdoor employs API hooking and custom PE loading to camouflage itself within host processes. This campaign aligns with China's strategic interest in monitoring Latin American governmental responses to US pressures on investments and infrastructure.