[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fY2PPQtB4FqnwFsixh8eQiZU-HGp29dNRWSfTourJvww":3},{"article":4,"iocs":40,"watch_terms":44,"solutions":45,"lesson":137},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":27},"e39ae45b-5914-4cdc-9f4a-fd16b9d3cecb","China-Linked FamousSparrow Deploys SparroWocky Backdoor in Latin America","china-linked-famoussparrow-deploys-sparrowocky-backdoor-in-latin-america-dbb59f","FamousSparrow is targeting Latin American governments with SparroWocky, a new C++ backdoor that exfiltrates files, takes screenshots and evades security tools.","The threat actor FamousSparrow, believed to be linked to China, has been observed targeting government entities in Latin America. They are deploying a new C++ backdoor named SparroWocky, which is capable of exfiltrating files, capturing screenshots, and evading security measures.","China-linked FamousSparrow targets Latin American governments with SparroWocky backdoor.","https:\u002F\u002Fhackread.com\u002Fchina-famoussparrow-sparrowocky-backdoor-latin-america\u002F",null,"2026-09-21T12:38:12+00:00","2026-09-22T00:00:25.884679+00:00",8,[17,20],{"name":18,"type":19},"FamousSparrow","threat_actor",{"name":21,"type":22},"C++","technology","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":23,"icon":12,"name":25,"slug":26},"Nation-state","nation-state",[28,30,35],{"category":29},{"id":23,"icon":12,"name":25,"slug":26},{"category":31},{"id":32,"icon":12,"name":33,"slug":34},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":36},{"id":37,"icon":12,"name":38,"slug":39},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[41],{"type":34,"value":42,"context":43},"SparroWocky","New C++ backdoor deployed by FamousSparrow",[],{"controls":46,"vendors":133},[47,76,105],{"slug":48,"name":49,"problem":50,"products":51},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[52,60,68],{"vendor_slug":53,"vendor_name":54,"vendor_logo":55,"product_slug":56,"product_name":57,"url":58,"description":59},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":64,"product_name":65,"url":66,"description":67},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"slug":77,"name":78,"problem":79,"products":80},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[81,89,97],{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-network","Darktrace \u002F NETWORK","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Fhybrid-network","Network detection and response based on learning normal behaviour.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"corelight","Corelight","\u002Fvendor-logos\u002Fcorelight.png","open-ndr","Corelight Open NDR","https:\u002F\u002Fcorelight.com\u002Fplatform\u002F","Network detection and response based on Zeek and Suricata.",{"slug":39,"name":106,"problem":107,"products":108},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[109,117,125],{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","google-threat-intelligence","Google Threat Intelligence","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fthreat-intelligence","Threat intelligence from Mandiant's frontline investigations, Google's threat analysts, open sources and Google's own visibility, in one service.",{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","recorded-future-cyber-operations","Recorded Future Cyber Operations","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fcyber-operations","Threat intelligence built into security operations workflows, to prioritise alerts and act on threats before they arrive.",[134],{"slug":69,"name":70,"logo_path":71,"roles":135},[136],"reported_by",{"slug":138,"title":139,"body":140,"framework_refs":141,"framework_notes":153},"china-linked-famoussparrow-targets-latin-american-governments-with-sparrowocky-backdoor","China-Linked FamousSparrow Targets Latin American Governments with SparroWocky Backdoor","The FamousSparrow threat actor, likely state-sponsored by China, has deployed a sophisticated C++ backdoor called SparroWocky against government entities in Latin America, enabling file exfiltration, screenshot capture, and active evasion of security tools. This campaign highlights the persistent risk of advanced persistent threats (APTs) targeting government infrastructure, particularly in regions that may have less mature cybersecurity defenses. The backdoor's ability to evade security measures suggests that traditional signature-based detection alone is insufficient against nation-state-level adversaries. Organizations must adopt layered defenses, behavioral monitoring, and rapid incident response capabilities to detect and contain such intrusions before sensitive data is exfiltrated.",[142,143,144,145,146,147,148,149,150,151,152],"CIS Control 13 - Network Monitoring and Defense","CIS Control 10 - Malware Defenses","CIS Control 16 - Application Software Security","NIST SP 800-53 SI-3 - Malicious Code Protection","NIST SP 800-53 IR-4 - Incident Handling","NIST SP 800-53 SC-7 - Boundary Protection","NIST SP 800-53 AU-6 - Audit Record Review, Analysis, and Reporting","MITRE ATT&CK T1041 - Exfiltration Over C2 Channel","MITRE ATT&CK T1113 - Screen Capture","NIST CSF DE.CM-1 - Network Monitoring","ITIL Service Management - Security Incident Management",{}]