Attribution: reported
Profile assembled from related reporting.
Known campaigns
—
Malware
—
Target industries
—
Target regions
—
A China-linked espionage group known as FamousSparrow has been observed using a new backdoor called SparroWocky in attacks against government organizations in Latin America. The malware provides remote access and control, enabling potential data exfiltration and persistent compromise. Specific exploitation vectors and victim counts remain unconfirmed.
The China-aligned state-sponsored threat actor FamousSparrow has been observed deploying a previously unreported modular C++ backdoor named SparroWocky in attacks targeting multiple Latin American countries since at least August 2025. ESET researchers reported the findings, highlighting the actor's continued focus on espionage in the region.
.jpg?width=720&quality=80&disable=upscale)
A cyberespionage campaign attributed to the FamousSparrow APT group, believed to be operating on behalf of the Chinese government, has been targeting US political interests across Latin America. The operation utilizes a previously undocumented stealthy backdoor to gain persistent access to sensitive systems. The campaign coincides with heightened geopolitical tensions and competition for influence in the region. While the specific initial infection vectors and full scope of compromise remain under investigation, the activity underscores the growing threat of state-sponsored espionage targeting political infrastructure.
A spear-phishing campaign attributed to a China-nexus group linked to FamousSparrow has been targeting organizations in Central Asia. The attack delivers a flurry of Remote Access Trojans (RATs), providing insight into the geopolitical, technical, and strategic objectives of the country's APT actors. The campaign was reported by Dark Reading on August 19, 2026.