Bright Nexus

Published on September 17, 2026

Chinese Hackers Deploy SparroWocky Backdoor in Government Espionage Attacks

Severity
Medium

Detail

The China-linked espionage group FamousSparrow has been using a new modular backdoor named SparroWocky in attacks against government organizations across Latin America. According to ESET researchers, the activity has been ongoing for more than a year, with SparroWocky replacing the group’s previously used SparrowDoor backdoor.

SparroWocky was observed targeting government organizations in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela. ESET believes the activity was focused on collecting intelligence related to how Latin American governments were responding to increasing U.S. pressure and engagement involving Chinese economic interests.

SparroWocky is a modular C++ backdoor containing code from open-source projects. The malware includes multiple anti-analysis and evasion mechanisms designed to conceal malicious activity from security products and analysis tools.

How?

SparroWocky is delivered through a DLL side-loading chain consisting of a legitimate executable, a modified malicious DLL, and an RC4-encrypted .dat payload. The loader decrypts the payload and reflectively maps it directly into memory, avoiding the creation of a conventional malicious executable on disk.

The malware uses several techniques to evade analysis and security monitoring, including:

• Dynamic Windows API resolution through hashing.
• Runtime code patching.
• Process memory manipulation.
• Call-stack and threat-origin spoofing.
• Manipulation of low-level structures used to track loaded modules.
• Disguising malicious in-memory code and DLLs as legitimate Windows components.

SparroWocky also uses the MinHook library to intercept the Windows CreateThread function. Newly created threads can appear to start from the legitimate Windows AnimateWindow API rather than their actual malicious start address. The malware can establish persistence through a Windows service named ProcAuditManager or through the Windows Run registry key using the value SnapCart. Depending on available privileges, the registry persistence can be created under either HKLM or HKCU.

Impact

SparroWocky provides extensive remote-access and post-compromise capabilities. The backdoor can:

• Execute commands and executable files.
• Load and execute Beacon Object Files directly in memory.
• Collect system, network, user, domain and Windows-version information.
• Enumerate drives, directories and files.
• Enumerate displays and active user sessions.
• Upload, download, copy, move, rename and delete files.
• Capture screenshots every 500 milliseconds and transmit only changed screen regions after the initial full-screen image.
• Create processes within another logged-in user’s session.
• Operate as a TCP proxy and forward connections.
• Remove its persistence and delete its own files.

The malware encrypts stolen information using RC4 and communicates with command-and-control infrastructure through TLS-protected connections. ESET identified at least 18 C2 addresses communicating with the malware directly over ports 443 or 8080, or through HTTP and SOCKS5 proxies.

Recommendation

• Investigate unexpected DLL side-loading behavior.
• Monitor for suspicious service creation and unexpected Run-key modifications.
• Investigate in-memory PE execution and unauthorized Beacon Object File-like activity.
• Review outbound TLS connections to unfamiliar IP-based infrastructure, particularly traffic over ports 443 and 8080.
• Compare security telemetry against the indicators of compromise associated with the activity.

Indicators of Compromise (IOCs)

Files

SHA-1FilenameDetectionDescription
3209689E509205CCDB7E49062B7B407DDC23CAC1winfsp-x64.dllWin64/Agent.HUPSparroWocky loader.
52C6646759CF6037BB17466203631C4BD794532F52C6646759CF6037BB17466203631C4BD794532Fwinfsp-x64.dllWin64/Agent.HUPSparroWocky loader.
99E7070B5AF24A0FE1E6FEBE5954B03CB385E91FDukeQt.dllWin64/Agent.ISFSparroWocky loader.
44F0A22B143B79FA760BF31E14C8FFF714C8A2A1N/A (in-memory)Win64/Agent.ASWSparroWocky backdoor.
9AA9FF61BC63CCAB9074FE837F39C980CA9DDC8CN/A (in-memory)Win64/Agent.ASWSparroWocky backdoor.

Network
IPDomainHosting providerFirst seenDetails
38.54.57[.]17N/ALightNode‑BR2026‑02‑25SparroWocky C&C server.
38.60.197[.]55N/AKaopu Cloud HK Limited2026‑03‑16SparroWocky C&C server.
38.60.209[.]106N/AKaopu Cloud HK Limited2026‑02‑26SparroWocky C&C server.
38.60.224[.]51N/AKaopu Cloud HK Limited2026‑02‑25SparroWocky C&C server.
38.60.224[.]235N/AKaopu Cloud HK Limited2026‑02‑24SparroWocky C&C server.
38.60.241[.]65N/ACogent Communications2026‑03‑10SparroWocky C&C server.
38.60.241[.]127N/ACogent Communications2026‑03‑04SparroWocky C&C server.
38.60.241[.]193N/AKaopuCloud‑BR2026‑01‑22SparroWocky C&C server.
77.111.101[.]40N/ALatitude.sh2026‑05‑20SparroWocky C&C server.
91.148.134[.]115N/ACharles‑R Paquet2026‑06‑17SparroWocky C&C server.
130.94.101[.]82N/ANTT America, Inc2026‑02‑26SparroWocky C&C server.
140.99.164[.]199N/APrivate Customer2026‑02‑26SparroWocky C&C server.
149.104.87[.]228N/ALightnode‑MX2026‑02‑24SparroWocky C&C server.
149.104.90[.]203N/ABEDGE CO LIMITED2026‑01‑22SparroWocky C&C server.
216.238.92[.]2N/AThe Constant Company, LLC2026‑02‑25SparroWocky C&C server.
216.238.105[.]53N/AThe Constant Company, LLC2026‑01‑22SparroWocky C&C server.
216.238.110[.]120N/AThe Constant Company, LLC2025‑12‑11SparroWocky C&C server.
216.238.121[.]164N/AThe Constant Company, LLC2026‑03‑16SparroWocky C&C server.

Conclusion

FamousSparrow has replaced its previously used SparrowDoor backdoor with the new SparroWocky malware in espionage operations targeting government organizations across Latin America. The modular C++ backdoor combines extensive remote-access capabilities with memory-resident execution, DLL side-loading, stealthy persistence, runtime code manipulation, call-stack spoofing, and other anti-analysis techniques.

The observed capabilities allow the malware to collect system information, manage files, capture screenshots, execute commands, establish network proxying and execute Beacon Object Files in memory, supporting post-compromise espionage activities.

Source

https://www.bleepingcomputer.com/news/security/chinese-hackers-use-sparrowocky-malware-in-govt-espionage-attacks/
https://gbhackers.com/sparrowocky-backdoor/#google_vignette
https://github.com/eset/malware-ioc/tree/master/famoussparrow/
https://www.welivesecurity.com/en/eset-research/beware-sparrowock-backdoor-bites-commands-catch/