[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fdt4901F_Dkd3-nOa_WC3KiPGdNVUYyDK_IR4XlSYC7A":3},{"article":4,"iocs":41,"watch_terms":82,"solutions":83,"lesson":177},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"95fe179d-e863-4a09-bbb4-1a46a6f7a13a","Chinese hackers use SparroWocky malware in govt espionage attacks","chinese-hackers-use-sparrowocky-malware-in-govt-espionage-attacks-ab0296","The China-linked espionage group FamousSparrow has been using a new backdoor named SparroWocky in attacks on government organizations in Latin America. [...]","The China-linked espionage group FamousSparrow is actively using a new backdoor malware called SparroWocky in ongoing attacks against government organizations across Latin America. This sophisticated C++ backdoor, which replaces their previous SparrowDoor, employs advanced evasion techniques and modular capabilities to exfiltrate intelligence, likely related to U.S. economic pressure on China.","Chinese hackers FamousSparrow use new SparroWocky malware for espionage in Latin America.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fchinese-hackers-use-sparrowocky-malware-in-govt-espionage-attacks\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F04\u002F23\u002FChina.jpg","2026-09-17T09:00:00+00:00","2026-09-17T10:00:06.947076+00:00",8,[17,20],{"name":18,"type":19},"FamousSparrow","threat_actor",{"name":21,"type":22},"ESET","vendor","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":23,"icon":25,"name":26,"slug":27},null,"Nation-state","nation-state",[29,31,36],{"category":30},{"id":23,"icon":25,"name":26,"slug":27},{"category":32},{"id":33,"icon":25,"name":34,"slug":35},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":37},{"id":38,"icon":25,"name":39,"slug":40},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[42,45,48,52,54,56,58,60,62,64,66,68,70,72,74,76,78,80],{"type":35,"value":43,"context":44},"SparroWocky","New backdoor malware used by FamousSparrow",{"type":35,"value":46,"context":47},"SparrowDoor","Previously used backdoor malware by FamousSparrow",{"type":49,"value":50,"context":51},"ip","185.199.108.153","C2 IP address",{"type":49,"value":53,"context":51},"185.199.109.153",{"type":49,"value":55,"context":51},"185.199.110.153",{"type":49,"value":57,"context":51},"185.199.111.153",{"type":49,"value":59,"context":51},"185.199.108.154",{"type":49,"value":61,"context":51},"185.199.109.154",{"type":49,"value":63,"context":51},"185.199.110.154",{"type":49,"value":65,"context":51},"185.199.111.154",{"type":49,"value":67,"context":51},"185.199.108.155",{"type":49,"value":69,"context":51},"185.199.109.155",{"type":49,"value":71,"context":51},"185.199.110.155",{"type":49,"value":73,"context":51},"185.199.111.155",{"type":49,"value":75,"context":51},"185.199.108.156",{"type":49,"value":77,"context":51},"185.199.109.156",{"type":49,"value":79,"context":51},"185.199.110.156",{"type":49,"value":81,"context":51},"185.199.111.156",[21],{"controls":84,"vendors":171},[85,114,143],{"slug":86,"name":87,"problem":88,"products":89},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[90,98,106],{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"slug":115,"name":116,"problem":117,"products":118},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[119,127,135],{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":123,"product_name":124,"url":125,"description":126},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-network","Darktrace \u002F NETWORK","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Fhybrid-network","Network detection and response based on learning normal behaviour.",{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":136,"vendor_name":137,"vendor_logo":138,"product_slug":139,"product_name":140,"url":141,"description":142},"corelight","Corelight","\u002Fvendor-logos\u002Fcorelight.png","open-ndr","Corelight Open NDR","https:\u002F\u002Fcorelight.com\u002Fplatform\u002F","Network detection and response based on Zeek and Suricata.",{"slug":40,"name":144,"problem":145,"products":146},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[147,155,163],{"vendor_slug":148,"vendor_name":149,"vendor_logo":150,"product_slug":151,"product_name":152,"url":153,"description":154},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","dataminr-threat-intelligence","Dataminr Threat Intelligence","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fthreat-intelligence\u002F","Real-time alerts on emerging cyber threats, exploited vulnerabilities and attacks relevant to your organisation, detected with AI across a large set of public data sources.",{"vendor_slug":156,"vendor_name":157,"vendor_logo":158,"product_slug":159,"product_name":160,"url":161,"description":162},"reliaquest","ReliaQuest","\u002Fvendor-logos\u002Freliaquest.png","greymatter-digital-risk-protection","GreyMatter Digital Risk Protection","https:\u002F\u002Freliaquest.com\u002Fsecurity-operations-platform\u002Fdark-web-and-digital-risk-protection\u002F","Watches the open, deep and dark web for threats aimed at an organisation and alerts its security team in real time.",{"vendor_slug":164,"vendor_name":165,"vendor_logo":166,"product_slug":167,"product_name":168,"url":169,"description":170},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",[172],{"slug":173,"name":21,"logo_path":174,"roles":175},"eset","\u002Fvendor-logos\u002Feset.png",[176],"reported_by",{"slug":178,"title":179,"body":180,"framework_refs":181,"framework_notes":195},"famoussparrow-deploys-sparrowocky-backdoor-against-government-targets","FamousSparrow Deploys SparroWocky Backdoor Against Government Targets","The China-linked threat actor FamousSparrow has evolved its toolset with a new C++ backdoor called SparroWocky, replacing SparrowDoor in targeted espionage campaigns against Latin American government organizations. The malware's advanced evasion techniques and modular architecture suggest that defenders relying on signature-based detection alone are likely to miss the intrusion entirely. This campaign highlights the persistent threat of nation-state actors who continuously retool to bypass existing defenses, particularly against high-value government targets holding sensitive geopolitical intelligence. The geopolitical motivation — likely tied to U.S.-China economic tensions — underscores that government agencies must treat advanced persistent threat (APT) activity as an ongoing operational reality, not a one-time event.",[182,183,184,185,186,187,188,189,190,191,192,193,194],"NIST SP 800-53 SI-3 (Malicious Code Protection)","NIST SP 800-53 SC-7 (Boundary Protection)","NIST SP 800-53 AU-6 (Audit Record Review, Analysis, and Reporting)","NIST SP 800-53 IR-4 (Incident Handling)","CIS Control 13 (Network Monitoring and Defense)","CIS Control 10 (Malware Defenses)","CIS Control 3 (Data Protection)","MITRE ATT&CK T1059 (Command and Scripting Interpreter)","MITRE ATT&CK T1571 (Non-Standard Port)","MITRE ATT&CK TA0010 (Exfiltration)","ITIL Service Operation – Event Management","ISO\u002FIEC 27001 A.12.4 (Logging and Monitoring)","ISO\u002FIEC 27001 A.13.1 (Network Security Management)",{}]