Skip to content
OriginalSign in
Image: Dark Reading

Dark ReadingNate Nelson

Chinese Hackers Target Latin American Governments With New Malware

Part of the GhostEmperor story · since 27 Aug 2025

Quiet for 6 weekslast report 17 Sep25 articles10 outlets
27 Aug · BleepingComputer first11 Jun23 AugNowThis article25th of 25
  • Wed 27 Aug, 19:41 UTC. BleepingComputer, first report. Global Salt Typhoon hacking campaigns linked to Chinese tech firms.
  • Thu 28 Aug, 12:31 UTC. Security Affairs, its first report on the story. NSA, NCSC, and allies detailed TTPs associated with Chinese APT actors targeting critical infrastructure Orgs.
  • Thu 28 Aug, 14:45 UTC. The Hacker News, its first report on the story. Salt Typhoon Exploits Cisco, Ivanti, Palo Alto Flaws to Breach 600 Organizations Worldwide.
  • Thu 28 Aug, 14:45 UTC. SecurityWeek, its first report on the story. China’s Salt Typhoon Hacked Critical Infrastructure Globally for Years.
  • Fri 29 Aug, 08:00 UTC. Security Affairs. Dutch intelligence warn that China-linked APT Salt Typhoon targeted local critical infrastructure.
  • Fri 29 Aug, 12:30 UTC. DataBreaches, its first report on the story. FBI cyber cop: Salt Typhoon pwned ‘nearly every American’.
  • Tue 9 Sep, 01:40 UTC. The Hacker News. 45 Previously Unreported Domains Expose Longstanding Salt Typhoon Cyber Espionage.
  • Tue 9 Sep, 02:15 UTC. SecurityOnline, its first report on the story. Unmasking Salt Typhoon: A Report Exposes 45 New Domains from a Chinese APT Group.
  • Tue 9 Sep, 06:05 UTC. GBHackers, its first report on the story. Chinese Hackers Salt Typhoon and UNC4841 Team Up to Breach Critical Infrastructure.
  • Wed 24 Sep, 23:45 UTC. dti.domaintools.com, its first report on the story. Inside Salt Typhoon: China’s State-Corporate Advanced Persistent Threat.
  • Thu 25 Sep, 15:05 UTC. GBHackers. Chinese State-Sponsored Hackers Targeting Telecommunications Infrastructure to Steal Sensitive Data.
  • Sat 27 Sep, 01:10 UTC. SecurityOnline. Salt Typhoon: China’s State-Sponsored Espionage Group Infiltrates Global Telecoms for Long-Term Cyber Warfare.
  • Tue 21 Oct, 12:25 UTC. Security Affairs. China-Linked Salt Typhoon breaches European Telecom via Citrix exploit.
  • Wed 22 Oct, 06:05 UTC. GBHackers. New Salt Typhoon Attacks Leverage Zero-Days and DLL Sideloading.
  • Tue 16 Dec, 01:20 UTC. SecurityOnline. From Cisco Student Rivalry to Global Hackers: Salt Typhoon Breaches 80+ Telecos for Intelligence.
  • Fri 6 Feb, 01:41 UTC. SecurityOnline. Phantom in the Machine: Inside Salt Typhoon’s “SnappyBee” Backdoor.
  • Sun 3 May, 21:32 UTC. Security Affairs. Salt Typhoon breach IBM subsidiary in Italy: a warning for Europe’s digital defenses.
  • Tue 5 May, 02:31 UTC. Infosecurity, its first report on the story. US defence contractors warned of nation state edge device attacks.
  • Wed 13 May, 13:33 UTC. Dark Reading, its first report on the story. FamousSparrow hits Azerbaijani oil firm with DLL sideload.
  • Wed 13 May, 14:12 UTC. The Hacker News. Chinese hackers hit Azerbaijan energy firm with multi wave attack.
  • Thu 14 May, 09:51 UTC. Security Affairs. FamousSparrow hits Azerbaijani oil firm via Exchange exploits.
  • Thu 14 May, 12:30 UTC. SecurityWeek. Salt Typhoon hits Azerbaijani energy firm via Exchange exploit.
  • Thu 17 Sep, 14:12 UTC. The Hacker News. China-Aligned FamousSparrow Deploys SparroWocky Across Latin America.
  • Thu 17 Sep, 15:24 UTC. Infosecurity. China-Linked Hackers Target Latin America With SparroWocky Backdoor.
  • Thu 17 Sep, 19:37 UTC. Dark Reading. Chinese Hackers Target Latin American Governments With New Malware. This article, 25th of 25.

ESET researchers say the Chinese cyber-espionage group FamousSparrow has shifted its focus towards government organisations in Latin America. From July 2025, the group was observed targeting governments in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico and Venezuela, as well as a telecommunications organisation in Puerto Rico.

The activity appears aimed at gathering intelligence about how regional governments are responding to US pressure and Chinese investment, although ESET presents this as an assessment rather than confirmed attribution of a specific political objective. FamousSparrow is associated with, but not definitively confirmed to be linked to, the Earth Estries and Salt Typhoon groups.

In August 2025, the attackers replaced their older SparrowDoor backdoor with a newly developed tool called SparroWocky. The modular C++ malware is delivered through DLL sideloading and uses in-memory execution, encrypted command-and-control traffic and automated self-deletion to reduce the chance of detection. ESET researchers also identified stack spoofing, which can make malicious activity appear to originate from legitimate software, and support for Beacon Object Files (BOFs).

This allows the group to incorporate modules developed for legitimate red-team operations while reducing the need to drop additional files or use inter-process communication. ESET highlighted a Panamanian target involved in a dispute over ports previously operated by a China-based company, but did not report confirmed data theft or detail a specific defensive response beyond publishing indicators of compromise for organisations at risk.

How the story developed

All 25 articles
Quiet for 6 weekslast report 17 Sep25 articles10 outlets

25 articles from 10 outlets since 27 Aug. Quiet since 17 Sep. This was the 25th report, 386 days after the first.

Now27 Aug1522192921829 Apr13 SepFirst reportBleepingComputer · 27 Aug, 19:41This article25th of 25 · day 386Picked up againafter 11 days quiet
  • Wed 27 Aug, 19:41 UTC. BleepingComputer, first report. Global Salt Typhoon hacking campaigns linked to Chinese tech firms.
  • Thu 28 Aug, 12:31 UTC. Security Affairs, its first report on the story. NSA, NCSC, and allies detailed TTPs associated with Chinese APT actors targeting critical infrastructure Orgs.
  • Thu 28 Aug, 14:45 UTC. The Hacker News, its first report on the story. Salt Typhoon Exploits Cisco, Ivanti, Palo Alto Flaws to Breach 600 Organizations Worldwide.
  • Thu 28 Aug, 14:45 UTC. SecurityWeek, its first report on the story. China’s Salt Typhoon Hacked Critical Infrastructure Globally for Years.
  • Fri 29 Aug, 08:00 UTC. Security Affairs. Dutch intelligence warn that China-linked APT Salt Typhoon targeted local critical infrastructure.
  • Fri 29 Aug, 12:30 UTC. DataBreaches, its first report on the story. FBI cyber cop: Salt Typhoon pwned ‘nearly every American’.
  • Tue 9 Sep, 01:40 UTC. The Hacker News. 45 Previously Unreported Domains Expose Longstanding Salt Typhoon Cyber Espionage.
  • Tue 9 Sep, 02:15 UTC. SecurityOnline, its first report on the story. Unmasking Salt Typhoon: A Report Exposes 45 New Domains from a Chinese APT Group.
  • Tue 9 Sep, 06:05 UTC. GBHackers, its first report on the story. Chinese Hackers Salt Typhoon and UNC4841 Team Up to Breach Critical Infrastructure.
  • Wed 24 Sep, 23:45 UTC. dti.domaintools.com, its first report on the story. Inside Salt Typhoon: China’s State-Corporate Advanced Persistent Threat.
  • Thu 25 Sep, 15:05 UTC. GBHackers. Chinese State-Sponsored Hackers Targeting Telecommunications Infrastructure to Steal Sensitive Data.
  • Sat 27 Sep, 01:10 UTC. SecurityOnline. Salt Typhoon: China’s State-Sponsored Espionage Group Infiltrates Global Telecoms for Long-Term Cyber Warfare.
  • Tue 21 Oct, 12:25 UTC. Security Affairs. China-Linked Salt Typhoon breaches European Telecom via Citrix exploit.
  • Wed 22 Oct, 06:05 UTC. GBHackers. New Salt Typhoon Attacks Leverage Zero-Days and DLL Sideloading.
  • Tue 16 Dec, 01:20 UTC. SecurityOnline. From Cisco Student Rivalry to Global Hackers: Salt Typhoon Breaches 80+ Telecos for Intelligence.
  • Fri 6 Feb, 01:41 UTC. SecurityOnline. Phantom in the Machine: Inside Salt Typhoon’s “SnappyBee” Backdoor.
  • Sun 3 May, 21:32 UTC. Security Affairs. Salt Typhoon breach IBM subsidiary in Italy: a warning for Europe’s digital defenses.
  • Tue 5 May, 02:31 UTC. Infosecurity, its first report on the story. US defence contractors warned of nation state edge device attacks.
  • Wed 13 May, 13:33 UTC. Dark Reading, its first report on the story. FamousSparrow hits Azerbaijani oil firm with DLL sideload.
  • Wed 13 May, 14:12 UTC. The Hacker News. Chinese hackers hit Azerbaijan energy firm with multi wave attack.
  • Thu 14 May, 09:51 UTC. Security Affairs. FamousSparrow hits Azerbaijani oil firm via Exchange exploits.
  • Thu 14 May, 12:30 UTC. SecurityWeek. Salt Typhoon hits Azerbaijani energy firm via Exchange exploit.
  • Thu 17 Sep, 14:12 UTC. The Hacker News. China-Aligned FamousSparrow Deploys SparroWocky Across Latin America.
  • Thu 17 Sep, 15:24 UTC. Infosecurity. China-Linked Hackers Target Latin America With SparroWocky Backdoor.
  • Thu 17 Sep, 19:37 UTC. Dark Reading. Chinese Hackers Target Latin American Governments With New Malware. This article, 25th of 25.
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
  • Quiet time, folded
Show all 25 articles as a list
  1. Wed 27 AugDay 01
    1. Global Salt Typhoon hacking campaigns linked to Chinese tech firms19:41 · BleepingComputer · First report
  2. Thu 28 AugDay 13
    1. NSA, NCSC, and allies detailed TTPs associated with Chinese APT actors targeting critical infrastructure Orgs12:31 · Security Affairs
    2. Salt Typhoon Exploits Cisco, Ivanti, Palo Alto Flaws to Breach 600 Organizations Worldwide14:45 · The Hacker News
    3. China’s Salt Typhoon Hacked Critical Infrastructure Globally for Years14:45 · SecurityWeek
  3. Fri 29 AugDay 22
    1. Dutch intelligence warn that China-linked APT Salt Typhoon targeted local critical infrastructure08:00 · Security Affairs
    2. FBI cyber cop: Salt Typhoon pwned ‘nearly every American’12:30 · DataBreaches

  4. Quiet for 11 days

    Tue 9 SepDay 133
    1. 45 Previously Unreported Domains Expose Longstanding Salt Typhoon Cyber Espionage01:40 · The Hacker News · Picked up again
    2. Unmasking Salt Typhoon: A Report Exposes 45 New Domains from a Chinese APT Group02:15 · SecurityOnline
    3. Chinese Hackers Salt Typhoon and UNC4841 Team Up to Breach Critical Infrastructure06:05 · GBHackers

  5. Quiet for 2 weeks

    Wed 24 SepDay 281
    1. Inside Salt Typhoon: China’s State-Corporate Advanced Persistent Threat23:45 · dti.domaintools.com · Picked up again
  6. Thu 25 SepDay 291
    1. Chinese State-Sponsored Hackers Targeting Telecommunications Infrastructure to Steal Sensitive Data15:05 · GBHackers
  7. Sat 27 SepDay 311
    1. Salt Typhoon: China’s State-Sponsored Espionage Group Infiltrates Global Telecoms for Long-Term Cyber Warfare01:10 · SecurityOnline

  8. Quiet for 3 weeks

    Tue 21 OctDay 551
    1. China-Linked Salt Typhoon breaches European Telecom via Citrix exploit12:25 · Security Affairs · Picked up again
  9. Wed 22 OctDay 561
    1. New Salt Typhoon Attacks Leverage Zero-Days and DLL Sideloading06:05 · GBHackers

  10. Quiet for 8 weeks

    Tue 16 DecDay 1111
    1. From Cisco Student Rivalry to Global Hackers: Salt Typhoon Breaches 80+ Telecos for Intelligence01:20 · SecurityOnline · Picked up again

  11. Quiet for 7 weeks

    Fri 6 FebDay 1631
    1. Phantom in the Machine: Inside Salt Typhoon’s “SnappyBee” Backdoor01:41 · SecurityOnline · Picked up again

  12. Quiet for 12 weeks

    Sun 3 MayDay 2491
    1. Salt Typhoon breach IBM subsidiary in Italy: a warning for Europe’s digital defenses21:32 · Security Affairs · Picked up again
  13. Tue 5 MayDay 2511
    1. US defence contractors warned of nation state edge device attacks02:31 · Infosecurity

  14. Quiet for 8 days

    Wed 13 MayDay 2592
    1. FamousSparrow hits Azerbaijani oil firm with DLL sideload13:33 · Dark Reading · Picked up again
    2. Chinese hackers hit Azerbaijan energy firm with multi wave attack14:12 · The Hacker News
  15. Thu 14 MayDay 2602
    1. FamousSparrow hits Azerbaijani oil firm via Exchange exploits09:51 · Security Affairs
    2. Salt Typhoon hits Azerbaijani energy firm via Exchange exploit12:30 · SecurityWeek

  16. Quiet for 18 weeks

    Thu 17 SepDay 3863
    1. China-Aligned FamousSparrow Deploys SparroWocky Across Latin America14:12 · The Hacker News · Picked up again
    2. China-Linked Hackers Target Latin America With SparroWocky Backdoor15:24 · Infosecurity
    3. Chinese Hackers Target Latin American Governments With New Malware19:37 · Dark Reading · This article, 25th of 25

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in