A cyberespionage campaign attributed to the FamousSparrow APT group, believed to be operating on behalf of the Chinese government, has been targeting US political interests across Latin America. The operation utilizes a previously undocumented stealthy backdoor to gain persistent access to sensitive systems. The campaign coincides with heightened geopolitical tensions and competition for influence in the region. While the specific initial infection vectors and full scope of compromise remain under investigation, the activity underscores the growing threat of state-sponsored espionage targeting political infrastructure.

What should defenders do?

Organizations should monitor for indicators of compromise associated with the FamousSparrow activity. Implementing robust email security controls to block spear-phishing attempts, conducting supply-chain risk assessments, and ensuring network segmentation are recommended. Applying the latest security updates to all software and maintaining up-to-date threat intelligence feeds are essential defensive measures.

highThreat Actors

FamousSparrow APT Conducts Espionage Campaign Targeting US Political Interests in Latin America

Attributed to China, the operation leverages a stealthy backdoor to infiltrate political and diplomatic entities

CyberIntel DeskPublished 12 days agoUpdated less than a minute ago1 min read

FamousSparrow APT Conducts Espionage Campaign Targeting US Political Interests in Latin America

Key Takeaways

FamousSparrow APT, attributed to China, is conducting an espionage campaign targeting US political interests in Latin America.
A stealthy backdoor has been deployed to maintain persistent access to compromised systems.
The operation focuses on political and diplomatic entities, reflecting broader geopolitical competition in the region.

Related Security News

highCyber Attacks

Star Blizzard Campaign Targets 100+ Organizations with Fake Event Invitations

Microsoft reports that the Russian state-sponsored threat actor Star Blizzard has been conducting a sustained campaign since January 2026, using fake event invitations to trick targets into installing a backdoor on Windows computers. The operation has affected more than 100 organizations, primarily in the U.S. and U.K., with victims tied to Ukraine. At least one infection has been confirmed, though the full extent of breaches and data exfiltration remains unverified.

The Hacker Newsabout 6 hours ago1 min read