Researchers have linked a China-aligned threat actor to a new espionage campaign in Latin America. The group, widely identified as FamousSparrow, has been deploying a previously unknown backdoor called SparroWocky since at least August 2025, according to multiple security vendors.
SparroWocky is described as a modular C++ backdoor. Reports agree it has been used to break into government organizations across several Latin American countries. Dark Reading frames the activity in the context of US-China competition for influence in the region, while other outlets focus on the technical details of the malware.
One notable discrepancy: The Register's headline attributes the backdoor to Salt Typhoon, another Chinese APT, whereas the other four sources attribute it to FamousSparrow. The broader consensus is that the campaign is the work of FamousSparrow, but the conflicting attribution highlights how quickly reporting on new malware can diverge.