[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fXEqHGKCprL5tlDNGdmFL9xYObn9bzpbtqDv8wiftIzw":3},{"article":4,"iocs":45,"watch_terms":50,"solutions":51,"lesson":146},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":27,"category":28,"article_tags":32},"f9a96342-f676-44c2-a626-123a7af0403e","China-Aligned FamousSparrow Deploys SparroWocky Backdoor Across Latin America","china-aligned-famoussparrow-deploys-sparrowocky-backdoor-across-latin-america-f355c5","The China-aligned state-sponsored threat actor known as FamousSparrow has been observed deploying a previously unreported backdoor called SparroWocky in attacks targeting multiple countries in Latin America since at least August 2025. \"SparroWocky is a modular, C++ backdoor,\" ESET security researchers Alexandre Côté Cyr and Romain Dumont said in a technical report shared with The Hacker News","China-aligned threat actor FamousSparrow is deploying a new C++ backdoor named SparroWocky in Latin America since August 2025. The malware, which incorporates anti-analysis techniques and leverages open-source projects for communication and evasion, replaces the group's previous implant, SparrowDoor. Attacks have targeted governmental entities across multiple Latin American countries, with the initial access vector remaining unknown.","FamousSparrow deploys new SparroWocky backdoor in Latin America.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002Fchina-aligned-famoussparrow-deploys.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEiOuXwG1YyG0uUU23HOcrfuGGEs6q0HvIDe8f7tcoTc3Vg049ITdUDCK_oyfFs8F68GEANNMqayc_75ARq5bBdbIu8qplp_nwC8hWxALOjCCGyf_Pb76GvNjEEfoWybq1nM9WXuxoPvYiRN_vJewkghj5IAYOaCh9JulsW4DnZLCEOhg_mXL_ykI0_oJwah\u002Fs1600\u002Fchinese-hackers.jpg","2026-09-17T10:05:45+00:00","2026-09-17T14:00:31.704827+00:00",8,[17,20,22,24],{"name":18,"type":19},"FamousSparrow","threat_actor",{"name":21,"type":19},"Earth Estries",{"name":23,"type":19},"Salt Typhoon",{"name":25,"type":26},"MinHook","product","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":27,"icon":29,"name":30,"slug":31},null,"Nation-state","nation-state",[33,35,40],{"category":34},{"id":27,"icon":29,"name":30,"slug":31},{"category":36},{"id":37,"icon":29,"name":38,"slug":39},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":41},{"id":42,"icon":29,"name":43,"slug":44},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[46],{"type":47,"value":48,"context":49},"ip","216.238.110.120","C2 server IP address",[25],{"controls":52,"vendors":139},[53,82,111],{"slug":54,"name":55,"problem":56,"products":57},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[58,66,74],{"vendor_slug":59,"vendor_name":60,"vendor_logo":61,"product_slug":62,"product_name":63,"url":64,"description":65},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"slug":83,"name":84,"problem":85,"products":86},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[87,95,103],{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"corelight","Corelight","\u002Fvendor-logos\u002Fcorelight.png","open-ndr","Corelight Open NDR","https:\u002F\u002Fcorelight.com\u002Fplatform\u002F","Network detection and response based on Zeek and Suricata.",{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-network","Darktrace \u002F NETWORK","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Fhybrid-network","Network detection and response based on learning normal behaviour.",{"slug":44,"name":112,"problem":113,"products":114},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[115,123,131],{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":127,"product_name":128,"url":129,"description":130},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":135,"product_name":136,"url":137,"description":138},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","dataminr-threat-intelligence","Dataminr Threat Intelligence","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fthreat-intelligence\u002F","Real-time alerts on emerging cyber threats, exploited vulnerabilities and attacks relevant to your organisation, detected with AI across a large set of public data sources.",[140],{"slug":141,"name":142,"logo_path":143,"roles":144},"eset","ESET","\u002Fvendor-logos\u002Feset.png",[145],"reported_by",{"slug":147,"title":148,"body":149,"framework_refs":150,"framework_notes":164},"china-linked-famoussparrow-targets-latin-american-governments-with-new-sparrowocky-backdoor","China-Linked FamousSparrow Targets Latin American Governments with New SparroWocky Backdoor","The China-aligned threat actor FamousSparrow has deployed a sophisticated new C++ backdoor called SparroWocky against governmental entities across Latin America, replacing its prior implant SparrowDoor with a more evasion-capable tool. The malware incorporates anti-analysis techniques and leverages open-source projects to blend into normal network traffic, making detection significantly harder. With the initial access vector still unknown, organizations face compounded risk as defenders cannot easily prioritize where to harden their perimeter. This campaign underscores the persistent threat posed by state-aligned actors to government infrastructure in emerging regions that may have less mature cybersecurity programs. The ability of FamousSparrow to iteratively upgrade its toolset highlights the need for behavioral-based detection rather than reliance solely on known malware signatures.",[151,152,153,154,155,156,157,158,159,160,161,162,163],"CIS Control 10 - Malware Defenses","CIS Control 13 - Network Monitoring and Defense","CIS Control 17 - Incident Response Management","NIST SP 800-61 - Computer Security Incident Handling Guide","NIST SP 800-94 - Guide to Intrusion Detection and Prevention Systems","NIST DE.CM-1 - Network Monitoring","NIST DE.AE-2 - Detected Events Analysis","NIST RS.RP-1 - Response Plan Execution","MITRE ATT&CK T1027 - Obfuscated Files or Information","MITRE ATT&CK T1071 - Application Layer Protocol","MITRE ATT&CK TA0011 - Command and Control","ISO\u002FIEC 27001 A.16 - Information Security Incident Management","ITIL - Event Management and Incident Management Processes",{}]