China-Aligned FamousSparrow Deploys SparroWocky Backdoor Across Latin America

The China-aligned threat actor FamousSparrow has deployed a sophisticated new C++ backdoor called SparroWocky against governmental entities across Latin America, replacing its prior implant SparrowDoor with a more evasion-capable tool. The malware incorporates anti-analysis techniques and leverages open-source projects to blend into normal network traffic, making detection significantly harder. With the initial access vector still unknown, organizations face compounded risk as defenders cannot easily prioritize where to harden their perimeter. This campaign underscores the persistent threat posed by state-aligned actors to government infrastructure in emerging regions that may have less mature cybersecurity programs. The ability of FamousSparrow to iteratively upgrade its toolset highlights the need for behavioral-based detection rather than reliance solely on known malware signatures.