China-Linked FamousSparrow Deploys SparroWocky Backdoor in Latin America

ESET uncovered an active cyberespionage campaign by the China-aligned FamousSparrow group using a new modular C++ backdoor named SparroWocky to target government organizations across multiple Latin American countries; the report details the trident DLL-sideloading loader, reflective in-memory loading with removed PE headers, anti-analysis measures (stack spoofing, reflective loading, SilentMoonwalk), capabilities (system reconnaissance, command execution, screenshots, TLS/RC4 exfiltration, TCP proxying) and observed victimology in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico and Venezuela.