FamousSparrow SparroWocky Latin America government espionage campaign
Campaign
Summary
Hide ▲
Show ▼
The FamousSparrow espionage campaign has shifted to SparroWocky, a new backdoor used against government organizations in Latin America. The operation has been active for more than a year and has targeted organizations in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela. Researchers assess the objective is to gather intelligence on how Latin American governments are responding to U.S. pressure on Chinese economic interests. The change in tooling shows a sustained, regionally focused operation with continued offensive activity.
Related Happenings
FamousSparrow SparroWocky backdoor activity against Latin American governments
Malware Activity
H score23
First: 17.09.2026 12:00
Last: 17.09.2026 12:00
Sources 1
How related:
The China-linked espionage group FamousSparrow has been using a new backdoor named SparroWocky in attacks on government organizations in Latin America.
About this happening:
The FamousSparrow espionage group is using the new SparroWocky backdoor to target government organizations in Latin America, extending a long-running intrusion operati...
FamousSparrow SparroWocky backdoor activity against Latin American governments
Malware ActivityHow related: The China-linked espionage group FamousSparrow has been using a new backdoor named SparroWocky in attacks on government organizations in Latin America.
About this happening: The FamousSparrow espionage group is using the new SparroWocky backdoor to target government organizations in Latin America, extending a long-running intrusion operati...
FishMonger multi-country government espionage campaign
Campaign
H score33
First: 16.06.2026 17:30
Last: 16.06.2026 17:30
Sources 1
About this happening:
FishMonger ran a multi-country espionage campaign against government bodies in Honduras, Taiwan, Thailand and Pakistan across 2023 and 2024. The activity point...
FishMonger multi-country government espionage campaign
CampaignAbout this happening: FishMonger ran a multi-country espionage campaign against government bodies in Honduras, Taiwan, Thailand and Pakistan across 2023 and 2024. The activity point...
Earth Lusca Operation FishMedley espionage campaign
Campaign
H score38
First: 16.06.2026 12:44
Last: 16.06.2026 12:44
Sources 1
About this happening:
A multi-country espionage campaign tied to Earth Lusca / FishMonger is now linked to Operation FishMedley, a January–October 2022 effort that reached seven organ...
Earth Lusca Operation FishMedley espionage campaign
CampaignAbout this happening: A multi-country espionage campaign tied to Earth Lusca / FishMonger is now linked to Operation FishMedley, a January–October 2022 effort that reached seven organ...
FamousSparrow Middle East maritime and energy targeting campaign
Campaign
H score33
First: 29.05.2026 12:00
Last: 29.05.2026 12:00
Sources 1
About this happening:
China-aligned FamousSparrow escalated a maritime and energy espionage campaign across the Middle East, putting regional shipping and infrastructure intelligence at gre...
FamousSparrow Middle East maritime and energy targeting campaign
CampaignAbout this happening: China-aligned FamousSparrow escalated a maritime and energy espionage campaign across the Middle East, putting regional shipping and infrastructure intelligence at gre...
Webworm multi-country targeting campaign against government and enterprise victims
Campaign
H score38
First: 20.05.2026 15:51
Last: 20.05.2026 15:51
Sources 1
About this happening:
Webworm is running a multi-country targeting campaign against government agencies and enterprises, expanding the risk of persistent access across several regions. The...
Webworm multi-country targeting campaign against government and enterprise victims
CampaignAbout this happening: Webworm is running a multi-country targeting campaign against government agencies and enterprises, expanding the risk of persistent access across several regions. The...
Timeline
-
17.09.2026 12:00 2 articles · 1h ago
FamousSparrow deploys SparroWocky against government organizations in Latin America
Initial DisclosureFamousSparrow is using the SparroWocky backdoor in espionage operations against government organizations in Latin America, replacing the earlier SparrowDoor tooling. ESET says the campaign has been active for more than a year, with targeting observed in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela, and researchers identified at least 18 command-and-control addresses communicating with the malware over port 443 or 8080, or through HTTP and SOCKS5 proxies. ESET also described SparroWocky as a modular C++ backdoor delivered through DLL side-loading after RC4-decrypted payload loading, with anti-analysis and persistence features used to evade security products.
Show sources
- Chinese hackers use SparroWocky malware in govt espionage attacks — www.bleepingcomputer.com — 17.09.2026 12:00
- Chinese hackers use SparroWocky malware in govt espionage attacks — www.bleepingcomputer.com — 17.09.2026 12:00