Skip to content
OriginalSign in
Image: Infosecurity

Infosecurity

China-Linked Hackers Target Latin America With SparroWocky Backdoor

Part of the GhostEmperor story · since 27 Aug 2025

Quiet for 6 weekslast report 17 Sep25 articles10 outlets
27 Aug · BleepingComputer first11 Jun23 AugNowThis article24th of 25
  • Wed 27 Aug, 19:41 UTC. BleepingComputer, first report. Global Salt Typhoon hacking campaigns linked to Chinese tech firms.
  • Thu 28 Aug, 12:31 UTC. Security Affairs, its first report on the story. NSA, NCSC, and allies detailed TTPs associated with Chinese APT actors targeting critical infrastructure Orgs.
  • Thu 28 Aug, 14:45 UTC. The Hacker News, its first report on the story. Salt Typhoon Exploits Cisco, Ivanti, Palo Alto Flaws to Breach 600 Organizations Worldwide.
  • Thu 28 Aug, 14:45 UTC. SecurityWeek, its first report on the story. China’s Salt Typhoon Hacked Critical Infrastructure Globally for Years.
  • Fri 29 Aug, 08:00 UTC. Security Affairs. Dutch intelligence warn that China-linked APT Salt Typhoon targeted local critical infrastructure.
  • Fri 29 Aug, 12:30 UTC. DataBreaches, its first report on the story. FBI cyber cop: Salt Typhoon pwned ‘nearly every American’.
  • Tue 9 Sep, 01:40 UTC. The Hacker News. 45 Previously Unreported Domains Expose Longstanding Salt Typhoon Cyber Espionage.
  • Tue 9 Sep, 02:15 UTC. SecurityOnline, its first report on the story. Unmasking Salt Typhoon: A Report Exposes 45 New Domains from a Chinese APT Group.
  • Tue 9 Sep, 06:05 UTC. GBHackers, its first report on the story. Chinese Hackers Salt Typhoon and UNC4841 Team Up to Breach Critical Infrastructure.
  • Wed 24 Sep, 23:45 UTC. dti.domaintools.com, its first report on the story. Inside Salt Typhoon: China’s State-Corporate Advanced Persistent Threat.
  • Thu 25 Sep, 15:05 UTC. GBHackers. Chinese State-Sponsored Hackers Targeting Telecommunications Infrastructure to Steal Sensitive Data.
  • Sat 27 Sep, 01:10 UTC. SecurityOnline. Salt Typhoon: China’s State-Sponsored Espionage Group Infiltrates Global Telecoms for Long-Term Cyber Warfare.
  • Tue 21 Oct, 12:25 UTC. Security Affairs. China-Linked Salt Typhoon breaches European Telecom via Citrix exploit.
  • Wed 22 Oct, 06:05 UTC. GBHackers. New Salt Typhoon Attacks Leverage Zero-Days and DLL Sideloading.
  • Tue 16 Dec, 01:20 UTC. SecurityOnline. From Cisco Student Rivalry to Global Hackers: Salt Typhoon Breaches 80+ Telecos for Intelligence.
  • Fri 6 Feb, 01:41 UTC. SecurityOnline. Phantom in the Machine: Inside Salt Typhoon’s “SnappyBee” Backdoor.
  • Sun 3 May, 21:32 UTC. Security Affairs. Salt Typhoon breach IBM subsidiary in Italy: a warning for Europe’s digital defenses.
  • Tue 5 May, 02:31 UTC. Infosecurity, its first report on the story. US defence contractors warned of nation state edge device attacks.
  • Wed 13 May, 13:33 UTC. Dark Reading, its first report on the story. FamousSparrow hits Azerbaijani oil firm with DLL sideload.
  • Wed 13 May, 14:12 UTC. The Hacker News. Chinese hackers hit Azerbaijan energy firm with multi wave attack.
  • Thu 14 May, 09:51 UTC. Security Affairs. FamousSparrow hits Azerbaijani oil firm via Exchange exploits.
  • Thu 14 May, 12:30 UTC. SecurityWeek. Salt Typhoon hits Azerbaijani energy firm via Exchange exploit.
  • Thu 17 Sep, 14:12 UTC. The Hacker News. China-Aligned FamousSparrow Deploys SparroWocky Across Latin America.
  • Thu 17 Sep, 15:24 UTC. Infosecurity. China-Linked Hackers Target Latin America With SparroWocky Backdoor. This article, 24th of 25.
  • Thu 17 Sep, 19:37 UTC. Dark Reading. Chinese Hackers Target Latin American Governments With New Malware.

China-aligned threat actor FamousSparrow has replaced its long-running SparrowDoor implant with a new backdoor called SparroWocky, according to ESET Research. The group has deployed the malware against government entities in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico and Venezuela since at least August 2025.

ESET attributed the campaign to FamousSparrow with high confidence, partly because some early SparroWocky infections were delivered by SparrowDoor, which it said is used only by that group. The attackers gained access by exploiting publicly reachable Microsoft Exchange servers. From mid-2025 into 2026, 90% of FamousSparrow targets recorded in ESET telemetry were in Latin America.

ESET described SparroWocky as a separate malware family rather than a SparrowDoor variant. The modular C++ backdoor can run commands, execute files, operate as a TCP proxy, gather host and network information, exfiltrate files, take recurring screenshots and load Beacon Object Files. Stolen data is encrypted with RC4 and sent over TLS. The malware also includes evasion features such as runtime code patching, forged call stacks and hooks that make its threads report harmless start addresses.

ESET said FamousSparrow had previously run open-source offensive tools alongside its malware, making the integration of this capability into SparroWocky a notable change.

ESET assessed that the group’s near-exclusive focus on Latin America from July 2025 could reflect Chinese strategic interests in the region, although it could not determine whether this represented a formal mandate or a temporary response to events. It cited one Panamanian target involved in a dispute over two canal-area ports. The group has been active since at least 2019; links to Earth Estries remain unclear, and ESET tracks it separately from Salt Typhoon.

How the story developed

All 25 articles
Quiet for 6 weekslast report 17 Sep25 articles10 outlets

25 articles from 10 outlets since 27 Aug. Quiet since 17 Sep. This was the 24th report, 386 days after the first.

Now27 Aug1522192921829 Apr13 SepFirst reportBleepingComputer · 27 Aug, 19:41This article24th of 25 · day 386Picked up againafter 11 days quiet
  • Wed 27 Aug, 19:41 UTC. BleepingComputer, first report. Global Salt Typhoon hacking campaigns linked to Chinese tech firms.
  • Thu 28 Aug, 12:31 UTC. Security Affairs, its first report on the story. NSA, NCSC, and allies detailed TTPs associated with Chinese APT actors targeting critical infrastructure Orgs.
  • Thu 28 Aug, 14:45 UTC. The Hacker News, its first report on the story. Salt Typhoon Exploits Cisco, Ivanti, Palo Alto Flaws to Breach 600 Organizations Worldwide.
  • Thu 28 Aug, 14:45 UTC. SecurityWeek, its first report on the story. China’s Salt Typhoon Hacked Critical Infrastructure Globally for Years.
  • Fri 29 Aug, 08:00 UTC. Security Affairs. Dutch intelligence warn that China-linked APT Salt Typhoon targeted local critical infrastructure.
  • Fri 29 Aug, 12:30 UTC. DataBreaches, its first report on the story. FBI cyber cop: Salt Typhoon pwned ‘nearly every American’.
  • Tue 9 Sep, 01:40 UTC. The Hacker News. 45 Previously Unreported Domains Expose Longstanding Salt Typhoon Cyber Espionage.
  • Tue 9 Sep, 02:15 UTC. SecurityOnline, its first report on the story. Unmasking Salt Typhoon: A Report Exposes 45 New Domains from a Chinese APT Group.
  • Tue 9 Sep, 06:05 UTC. GBHackers, its first report on the story. Chinese Hackers Salt Typhoon and UNC4841 Team Up to Breach Critical Infrastructure.
  • Wed 24 Sep, 23:45 UTC. dti.domaintools.com, its first report on the story. Inside Salt Typhoon: China’s State-Corporate Advanced Persistent Threat.
  • Thu 25 Sep, 15:05 UTC. GBHackers. Chinese State-Sponsored Hackers Targeting Telecommunications Infrastructure to Steal Sensitive Data.
  • Sat 27 Sep, 01:10 UTC. SecurityOnline. Salt Typhoon: China’s State-Sponsored Espionage Group Infiltrates Global Telecoms for Long-Term Cyber Warfare.
  • Tue 21 Oct, 12:25 UTC. Security Affairs. China-Linked Salt Typhoon breaches European Telecom via Citrix exploit.
  • Wed 22 Oct, 06:05 UTC. GBHackers. New Salt Typhoon Attacks Leverage Zero-Days and DLL Sideloading.
  • Tue 16 Dec, 01:20 UTC. SecurityOnline. From Cisco Student Rivalry to Global Hackers: Salt Typhoon Breaches 80+ Telecos for Intelligence.
  • Fri 6 Feb, 01:41 UTC. SecurityOnline. Phantom in the Machine: Inside Salt Typhoon’s “SnappyBee” Backdoor.
  • Sun 3 May, 21:32 UTC. Security Affairs. Salt Typhoon breach IBM subsidiary in Italy: a warning for Europe’s digital defenses.
  • Tue 5 May, 02:31 UTC. Infosecurity, its first report on the story. US defence contractors warned of nation state edge device attacks.
  • Wed 13 May, 13:33 UTC. Dark Reading, its first report on the story. FamousSparrow hits Azerbaijani oil firm with DLL sideload.
  • Wed 13 May, 14:12 UTC. The Hacker News. Chinese hackers hit Azerbaijan energy firm with multi wave attack.
  • Thu 14 May, 09:51 UTC. Security Affairs. FamousSparrow hits Azerbaijani oil firm via Exchange exploits.
  • Thu 14 May, 12:30 UTC. SecurityWeek. Salt Typhoon hits Azerbaijani energy firm via Exchange exploit.
  • Thu 17 Sep, 14:12 UTC. The Hacker News. China-Aligned FamousSparrow Deploys SparroWocky Across Latin America.
  • Thu 17 Sep, 15:24 UTC. Infosecurity. China-Linked Hackers Target Latin America With SparroWocky Backdoor. This article, 24th of 25.
  • Thu 17 Sep, 19:37 UTC. Dark Reading. Chinese Hackers Target Latin American Governments With New Malware.
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
  • Quiet time, folded
Show all 25 articles as a list
  1. Wed 27 AugDay 01
    1. Global Salt Typhoon hacking campaigns linked to Chinese tech firms19:41 · BleepingComputer · First report
  2. Thu 28 AugDay 13
    1. NSA, NCSC, and allies detailed TTPs associated with Chinese APT actors targeting critical infrastructure Orgs12:31 · Security Affairs
    2. Salt Typhoon Exploits Cisco, Ivanti, Palo Alto Flaws to Breach 600 Organizations Worldwide14:45 · The Hacker News
    3. China’s Salt Typhoon Hacked Critical Infrastructure Globally for Years14:45 · SecurityWeek
  3. Fri 29 AugDay 22
    1. Dutch intelligence warn that China-linked APT Salt Typhoon targeted local critical infrastructure08:00 · Security Affairs
    2. FBI cyber cop: Salt Typhoon pwned ‘nearly every American’12:30 · DataBreaches

  4. Quiet for 11 days

    Tue 9 SepDay 133
    1. 45 Previously Unreported Domains Expose Longstanding Salt Typhoon Cyber Espionage01:40 · The Hacker News · Picked up again
    2. Unmasking Salt Typhoon: A Report Exposes 45 New Domains from a Chinese APT Group02:15 · SecurityOnline
    3. Chinese Hackers Salt Typhoon and UNC4841 Team Up to Breach Critical Infrastructure06:05 · GBHackers

  5. Quiet for 2 weeks

    Wed 24 SepDay 281
    1. Inside Salt Typhoon: China’s State-Corporate Advanced Persistent Threat23:45 · dti.domaintools.com · Picked up again
  6. Thu 25 SepDay 291
    1. Chinese State-Sponsored Hackers Targeting Telecommunications Infrastructure to Steal Sensitive Data15:05 · GBHackers
  7. Sat 27 SepDay 311
    1. Salt Typhoon: China’s State-Sponsored Espionage Group Infiltrates Global Telecoms for Long-Term Cyber Warfare01:10 · SecurityOnline

  8. Quiet for 3 weeks

    Tue 21 OctDay 551
    1. China-Linked Salt Typhoon breaches European Telecom via Citrix exploit12:25 · Security Affairs · Picked up again
  9. Wed 22 OctDay 561
    1. New Salt Typhoon Attacks Leverage Zero-Days and DLL Sideloading06:05 · GBHackers

  10. Quiet for 8 weeks

    Tue 16 DecDay 1111
    1. From Cisco Student Rivalry to Global Hackers: Salt Typhoon Breaches 80+ Telecos for Intelligence01:20 · SecurityOnline · Picked up again

  11. Quiet for 7 weeks

    Fri 6 FebDay 1631
    1. Phantom in the Machine: Inside Salt Typhoon’s “SnappyBee” Backdoor01:41 · SecurityOnline · Picked up again

  12. Quiet for 12 weeks

    Sun 3 MayDay 2491
    1. Salt Typhoon breach IBM subsidiary in Italy: a warning for Europe’s digital defenses21:32 · Security Affairs · Picked up again
  13. Tue 5 MayDay 2511
    1. US defence contractors warned of nation state edge device attacks02:31 · Infosecurity

  14. Quiet for 8 days

    Wed 13 MayDay 2592
    1. FamousSparrow hits Azerbaijani oil firm with DLL sideload13:33 · Dark Reading · Picked up again
    2. Chinese hackers hit Azerbaijan energy firm with multi wave attack14:12 · The Hacker News
  15. Thu 14 MayDay 2602
    1. FamousSparrow hits Azerbaijani oil firm via Exchange exploits09:51 · Security Affairs
    2. Salt Typhoon hits Azerbaijani energy firm via Exchange exploit12:30 · SecurityWeek

  16. Quiet for 18 weeks

    Thu 17 SepDay 3863
    1. China-Aligned FamousSparrow Deploys SparroWocky Across Latin America14:12 · The Hacker News · Picked up again
    2. China-Linked Hackers Target Latin America With SparroWocky Backdoor15:24 · Infosecurity · This article, 24th of 25
    3. Chinese Hackers Target Latin American Governments With New Malware19:37 · Dark Reading

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in