The backdoor that bites, the instructions that catch

ESET Analysis’s ongoing monitoring of FamousSparrow has borne fruit as soon as once more. Our earlier public report on FamousSparrow revealed that this China-aligned APT group had developed two new variations of its customized backdoor named SparrowDoor. This time, we found that FamousSparrow has switched to a brand new backdoor, SparroWocky, and has been deploying it to a number of nations in Latin America since at the least August 2025.

In what was in all probability China’s response to the US displaying elevated curiosity in Latin America, FamousSparrow elevated its focusing on of the area to nearly completely focusing on it in July 2025. A month later, we observed that the group had began utilizing the brand new SparroWocky backdoor, which then shortly changed SparrowDoor as FamousSparrow’s principal implant.

SparroWocky is a modular, C++ backdoor. Its structure and the strategies utilized by its authors point out robust data of anti-analysis methods and Home windows internals. We selected to call the backdoor SparroWocky as a result of the primary samples we collected all comprise the primary stanza of Jabberwocky, a nonsense poem by Lewis Carroll. Fortuitously, whereas superior, SparroWocky’s interior workings are a lot much less arcane than a gyre and gimble within the wabe, so a by way of and thru [of] the vorpal blade allowed us to carry you an in depth evaluation of the backdoor.

Key factors of the blogpost:

• FamousSparrow is extensively focusing on governmental organizations in Latin America.
• Since August 2025, the group seems to be abandoning SparrowDoor in favor of SparroWocky, a brand new customized C++ backdoor.
• With the swap to SparroWocky, FamousSparrow began to include code from open-source initiatives instantly into its malware.
• SparroWocky is a full-featured backdoor that manipulates low-level buildings in reminiscence, and patches code at runtime in an effort to keep away from detection.
• SparroWocky has the potential to load and execute Beacon Object Recordsdata, a particular sort of executable file supported by many red-teaming and penetration-testing instruments.

FamousSparrow is a China-aligned cyberespionage group believed to have been lively since at the least 2019. We first publicly documented the group in a blogpost from September 2021 after we noticed it exploiting the ProxyLogon vulnerability. The group was initially recognized for focusing on accommodations all over the world however has additionally focused governments, worldwide organizations, commerce teams, engineering firms, and legislation companies. FamousSparrow is the one recognized person of the SparrowDoor backdoor.

We analyzed two variations of SparrowDoor in a 2025 blogpost, wherein we additionally mentioned the attribution claims across the group. As talked about by Pattern Micro, FamousSparrow is linked to Earth Estries; nevertheless, the precise nature of the hyperlink is just not totally recognized. FamousSparrow has additionally been publicly linked to Salt Hurricane, however, because of the absence of any technical indicators, we observe them as separate.

Based mostly on our investigation, we attribute the most recent marketing campaign and the SparroWocky backdoor to FamousSparrow with excessive confidence, since in among the first assaults involving this backdoor, SparroWocky was deployed by the FamousSparrow-exclusive SparrowDoor. Furthermore, not solely does the victimology match FamousSparrow’s earlier focusing on, now we have additionally recorded makes an attempt to deploy SparroWocky at lots of the similar organizations that had beforehand been focused with SparrowDoor.

Latin America within the crosshairs

As beforehand talked about, FamousSparrow at present seems to be targeted on high-profile targets in Latin America. This development began on the newest in July 2025 and has continued with the introduction of SparroWocky. In actual fact, from mid-2025 and into 2026, 90% of the group’s targets registered in our telemetry have been situated within the area. As depicted in Determine 1, we’ve seen the brand new backdoor deployed in opposition to governmental entities in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela. This represents a uncommon incidence among the many China-aligned APT teams that we at present observe, that are typically noticed all through varied world areas inside such an prolonged time-frame.

We consider that this focus is just not coincidental and sure displays China’s response to varied latest US initiatives within the area. Certainly, Donald Trump’s second presidential time period has led to an aggressive reaffirmation of US pursuits in Latin America, which threatens varied long-term investments that China has cultivated all through the continent within the final decade, in domains similar to vitality, mining, and telecommunications. We suspect that FamousSparrow’s actions are meant to assist China higher monitor and anticipate the response of native governments to present US pressures.

In some circumstances, now we have noticed components that clearly appear to substantiate this speculation. For example, one of many Panamanian entities we’ve seen being focused is instantly concerned within the ongoing industrial dispute concerning two main ports situated within the canal space, which have been, till not too long ago, operated by a China-based firm. Because the concession granted to this firm was legally challenged by the Panamanian authorities in early 2025, it appears extremely possible that FamousSparrow’s operation was meant to achieve early, privileged data of native authorities’ intentions on this challenge.

It isn’t clear whether or not the group’s obvious concentrate on Latin America might replicate a proper, geographical mandate, or whether or not this focus is simply non permanent and dictated by the present geopolitical circumstances.

Analyzing SparroWocky

SparroWocky is a full-featured, modular C++ backdoor constructed with modularity and stealthiness in thoughts. It appeared shortly after FamousSparrow began specializing in Latin America and shortly turned the group’s new flagship implant, changing SparrowDoor. It ought to be famous that SparroWocky is just not a variant of SparrowDoor, however is fairly a definite malware household. The transition to this new backdoor additionally got here with a higher stage of integration of open-source tooling into FamousSparrow’s workflow: whereas beforehand, standalone variations of those instruments have been deployed facet by facet with SparrowDoor, with SparroWocky, some have been included instantly into the malware.

A few of SparroWocky’s notable options embrace the flexibility to execute arbitrary recordsdata, to behave as a TCP proxy, and to execute instructions. The backdoor additionally collects normal details about the compromised machine, similar to the pc identify, the username, area identify, Home windows model, and the IP addresses of its community interfaces. SparroWocky can be able to exfiltrating recordsdata and taking screenshots periodically. Exfiltrated data is encrypted utilizing RC4 and despatched over the TLS protocol.

Relying on its configuration, SparroWocky can set up persistence both by making a devoted service or an entry in a registry Run key.

Loader

SparroWocky is deployed utilizing the frequent trident loader scheme, which consists of a official executable, a malicious DLL standing in for one required by that executable, and a file containing an encrypted payload (see Determine 2). The loader resides within the aforementioned DLL and is executed through DLL side-loading. We now have seen FamousSparrow use a variety of side-loading targets; normally, a patched model of the official DLL that the executable is meant to load. Whereas a lot of the file is left untouched, an arbitrary portion of the .textual content part is changed with the malicious code, and the entry level header is modified to level inside this patched area.

This has some defense-evasion properties: having the metadata and exported operate checklist of the malicious DLL be the identical as that of the official model permits it to extra simply mix in. For the reason that code within the patched area doesn’t align with the exported capabilities and calls within the untouched portion, automated evaluation instruments might have hassle recognizing operate boundaries.

The loader’s principal position is to extract and decrypt its payload from a file. These recordsdata, which usually have the identical identify because the executable however with a .dat extension, have a selected construction detailed in Determine 3. The file has a customized header that begins with a four-byte magic worth of 0x11328712, adopted by the dimensions of the configuration information, the dimensions of the payload, and a 16-byte RC4 key. This RC4 key’s used to decrypt the rest of the file, which accommodates the configuration for SparroWocky (detailed within the Configuration part) and the backdoor itself. We offer a script to decrypt SparroWocky payload recordsdata in our GitHub repository.

The plaintext backdoor payload is formatted as a transportable executable (PE) file with the MZ and PE magic values deleted. This executable payload is reflectively mapped instantly into reminiscence with out being written to disk. Thus, we consider that stripping these magic values is probably an try to evade in-memory protection mechanisms that use easy sample recognition to establish or dump suspicious sections of reminiscence.

SparroWocky

Our evaluation of SparroWocky is especially based mostly on a pattern compiled on November 17^th, 2025 in response to its PE timestamp (SHA-1: 44F0A22B143B79FA760BF31E14C8FFF714C8A2A1). The model of this backdoor seems to be 1.8, based mostly on the data collected by its fingerprint command defined in Desk 3.

As we already talked about, we selected the identify SparroWocky as a result of we discovered the primary stanza of Lewis Caroll’s Jabberwocky in a number of samples we collected. We consider that this stanza comes from the check vectors in RFC 7539, which defines the ChaCha20-Poly1305 encryption algorithm. The samples of SparroWocky additionally comprise different strings which can be used as check vectors in that RFC. Nonetheless, SparroWocky doesn’t use ChaCha20-Poly1305. Whereas we don’t know the precise model of Mbed TLS used within the backdoor, the check vectors have been current in that library previous to model 4.0.0.

Notably, SparroWocky depends at the least on the next public initiatives:

• Mbed TLS, a C library it makes use of to determine a safe communication channel with its C&C server,
• MinHook, a Home windows API hooking library it makes use of to cover the beginning deal with of newly created threads from safety merchandise, and
• COFF Loader (or an analogous mission) that it makes use of to allow dynamic loading and execution of in-memory plugins within the type of COFF objects.

Moreover, our evaluation revealed that the builders carried out varied strategies to evade monitoring instruments. This features a variant of a way referred to as SilentMoonwalk (or StackMoonwalk), which permits SparroWocky to spoof the decision stacks originating from MinHook routines. The backdoor additionally makes use of a customized API-hashing algorithm to dynamically resolve Home windows API capabilities. These are defined in higher element within the Anti-analysis strategies part.

Configuration

The SparroWocky loader extracts and decrypts its configuration from the payload .dat file situated in the identical listing, as defined within the Loader part. The RC4 key saved within the payload header is used to decrypt the configuration, which is offered within the type of a tab-separated string that’s then parsed and saved in a construction. The fields and their values are described in Desk 1 so as of look.

Desk 1. SparroWocky configuration

Capabilities

Argument-controlled habits

After parsing its configuration, the backdoor checks the command line of the method wherein it’s operating and behaves in another way based mostly on the quantity and worth of the arguments handed. If no arguments are current, SparroWocky merely units up persistence and executes the core logic of the backdoor. In any other case, the worth of the primary argument directs the malware to observe particular directions, as described in Desk 2.

Desk 2. SparroWocky command line arguments and their which means

* Defined within the Backdoor instructions part.

When SparroWocky is executed with the c choice, it reads an extra comma-separated checklist of parameters from normal enter (stdin):

• a command string,
• a timeout delay (in seconds), and
• optionally, the physique of a PE file.

If this final parameter is absent, the backdoor reads the executable specified within the command string from C:WindowsSystem32 and masses the related English MUI (Multilingual Consumer Interface) file (from C:WindowsSystem32en-US). This course of is described within the Host course of camouflage for dynamically loaded PEs part. In any other case, the PE file is executed by SparroWocky’s reflective loader, and the command string is handed as a command line. This performance is probably going meant to permit the backdoor to simply execute system utilities.

SparroWocky masses the desired executable into reminiscence and executes it with the offered command. On the similar time, the backdoor creates a brand new thread that calls ExitProcess to kill the method when the timeout delay expires. The loading course of includes organising hooks and forging buildings in reminiscence to camouflage the host course of earlier than operating the goal executable. These anti-analysis methods are defined in higher element within the devoted Host course of camouflage for dynamically loaded PEs part.

Moreover, when the malware is executed with out arguments or with the p choice, an occasion synchronization mechanism is began. This function prevents a number of cases of the backdoor from operating concurrently by leveraging a customized interprocess communication (IPC) mechanism. When a brand new occasion is launched, the at present operating occasion stops and, if the brand new occasion is launched from a unique location than the present one, the recordsdata and persistence configurations set by the at present operating occasion are deleted. That is achieved by utilizing three sorts of world objects: a mutex, an occasion, and a shared reminiscence block named MyMutexName, MyEventName, and MySharedMemName, respectively.

Backdoor instructions

The backdoor first establishes communication with its C&C server, then executes its core logic in an infinite loop, inside which it processes acquired instructions. These are dealt with by a customized class named WinHandler (derived from a ServerHandler customized class), in response to the runtime sort data (RTTI) current within the malware. Handlers for a minimal set of instructions are hardcoded within the command loop itself. ServerHandler has a devoted digital technique to deal with extra instructions. This technique is carried out in WinHandler. Whereas now we have not noticed different implementations of this technique, this structure would make it straightforward for its builders to alter the set of instructions that the backdoor can deal with. The checklist of supported instructions is proven in Desk 3.

Desk 3. SparroWocky instructions

* Hardcoded command.

Command 0x14 makes use of a barely modified model of RunCOFF from the open-source COFF Loader mission to load and execute a Beacon Object File (BOF). A BOF is a position-independent Frequent Object File Format (COFF) executable that’s meant to be run inside the reminiscence of an implant. BOFs have been first launched in Cobalt Strike and have since been adopted by different fashionable red-teaming frameworks similar to Brute Ratel, Metasploit, and Sliver. The change to RunCOFF resides within the decision of imported symbols. SparroWocky redirects calls to exterior libraries within the BOF to a stack-spoofing subroutine. This successfully hides and proxies calls made by the BOF object. As soon as the thing is loaded, the BOF loader finds and executes function_name, passing the arguments offered in function_arguments. The power to load BOFs permits FamousSparrow to make use of present modules and instruments designed to work with this file sort.

Self-deletion

As described within the Argument-controlled habits part, SparroWocky can delete itself completely from the system. This may be accomplished from the C&C server through command 0x13. First, the persistence mechanism beforehand set is eliminated after which the batch file proven in Determine 4 is created and executed.

@echo off
timeout /t 2
del "<legitimate_executable>" /f /q
del "<loader_library>" /f /q
del "<payload_filepath>" /f /q
del "%%0" /f /qn

Determine 4. Batch file for self-deletion

This deletes the recordsdata utilized by the backdoor: the official executable, the side-loading library, and the payload file. The batch file deletes itself on the finish of the script.

Anti-analysis strategies

SparroWocky employs a number of strategies to complicate its evaluation and to evade safety software program which may be in place. A typical approach that the backdoor makes use of is dynamic API decision through API hashing, however the backdoor additionally makes use of extra attention-grabbing ones, described under.

SilentMoonwalk

The primary noteworthy approach is known as SilentMoonwalk, which basically supplies a strategy to forge faux name stacks. Its objective is to forestall evaluation instruments and merchandise from inspecting the true caller of particular capabilities which can be regularly monitored, similar to Home windows API capabilities. This technique requires a number of initialization steps:

• Discovering the offset of RtlUserThreadStart and BaseThreadInitThunk, two capabilities which can be normally discovered in the beginning (or backside) of any name stack.
• Discovering a JOP (jump-oriented programming) and a ROP (return-oriented programming) gadget within the official kernel32.dll library to revive the unique name stack.

As soon as these necessities are met, when SparroWocky makes an obfuscated name to a Home windows API operate, it first saves the present context (registers); subsequent, it forges a faux stack utilizing the devices discovered beforehand, after which inserts the deal with of a stack and context restoration routine. This makes it seem as if the calls to Home windows API capabilities are originating from RtlUserThreadStart and BaseThreadInitThunk. Determine 5 exhibits the decision stack view from a debugging session utilizing WinDbg.

Within the case of SparroWocky, this system is used to obfuscate calls made by BOF-formatted plugins (command 0x14) or by the statically linked MinHook hooking library.

Concealing the thread begin deal with

SparroWocky makes use of the MinHook library to hook the CreateThread operate in an effort to conceal the unique lpStartAddress parameter from safety merchandise. Primarily, any thread created by SparroWocky would have AnimateWindow because the beginning deal with, which might possible be thought of official by a safety product. The patch utilized to AnimateWindow turns it right into a trampoline that merely executes the unique begin deal with, as illustrated in Determine 6.

Host course of camouflage for dynamically loaded PEs

The final notable piece of code from SparroWocky is its customized PE loader, used when executed with choice c. Whereas implementing PE loaders is just about routine for malware authors, SparroWocky authors took it a step additional and built-in host course of camouflage.

As described in Desk 2, when SparroWocky is executed with the c choice, it masses a PE file in reminiscence and executes it. If the file is just not handed as an argument, the PE loader parses the desired command line to extract the file’s identify. It searches for that filename within the C:WindowsSystem32 listing, however most significantly it retrieves the English localization MUI file related to the goal PE (saved as C:WindowsSystem32en-US<exe_name>.mui). In that case, the PE file is loaded in reminiscence, and some hooks are set to ensure any calls made by the loaded PE file to retrieve useful resource information, similar to RtlLoadString or RtlFindMessage, are redirected to the .mui information. This course of mirrors regular habits of Home windows when loading PEs, and reduces the danger of surprising errors.

The command line retrieved from Stdin is parsed and SparroWocky hooks the next capabilities, that are used to retrieve details about command line arguments, to make them level to this command line:

• GetCommandline[AW]
• __(w}getmainargs
• __p___argc
• __p___{w}argv

The PE loader can be capable of register the exception handlers of the newly loaded executable – an uncommon, but essential, addition – because it permits exceptions to be dealt with appropriately.

Lastly, earlier than calling the entry level of the loaded PE file, SparroWocky forges and inserts a faux LDR_DATA_TABLE_ENTRY construction within the doubly linked checklist of the PEB_LDR_DATA construction. This doubly linked checklist is utilized by Home windows to maintain observe of loaded modules and is normally monitored by safety merchandise. Determine 7 exhibits a snippet of the code used to set a few of its fields.

This final approach exhibits that SparroWocky authors possess a deep understanding of the Home windows PE loading mechanism and are keen to go the additional mile to camouflage the host course of and confuse monitoring software program.

Community protocol

To speak with its C&C server, SparroWocky makes use of the TLS encryption protocol. Underneath the hood, the backdoor makes use of the Mbed TLS library and the one component price mentioning is that it makes use of the personalization string acdbenus when initializing the deterministic random bit generator, as seen in Determine 8.

Earlier than the preliminary TLS handshake, a TCP connection is established with the C&C server utilizing certainly one of three connection modes:

A connection mode of 0 implies that SparroWocky makes use of the proxy at present configured on the machine or a direct TCP connection if no system proxy is configured. This configuration is retrieved by querying the ProxyServer registry worth situated beneath the registry key HKCUSoftwareMicrosoftWindowsCurrentVersionInternet Settings. If the connection to the proxy server is just not profitable, SparroWocky tries to attach through mode 1, then mode 2.

Connection mode 1 represents a connection through an HTTP proxy. This connection makes use of both the Negotiate (Kerberos or NTLM) or Primary authentication scheme with the username and password offered within the configuration. Each authentication strategies use generic HTTP headers with the Consumer-Agent string set to Mozilla/5.0.

Connection mode 2 makes use of a SOCKS5 proxy with out authentication (AUTH subject set to 0x00) or with a username and password (AUTH subject set to 0x02). The values utilized by the latter are offered within the configuration.

Command messages

As soon as the TLS handshake is full, SparroWocky sends the bytes 0x11223344 (big-endian) to point that it is able to obtain instructions in the primary session. The backdoor makes use of a easy format to obtain instructions and ship outcomes, as illustrated in Determine 9.

If the command_arg_size subject doesn’t equal 0, then extra information is to be acquired or despatched after the header. In that case, the info (command arguments or outcomes) is encrypted through RC4, and every command message makes use of a newly generated eight-byte key, which is shipped within the header.

Community infrastructure

SparroWocky makes use of the IP deal with of its C&C servers, which is mostly operating on port 443, to attach instantly. We now have additionally seen it operating on port 8080 in some circumstances. Whereas now we have noticed some self-signed certificates being reused throughout a number of servers, we do not need a dependable generic fingerprint.

Conclusion

Over the latter half of 2025 and the primary half of 2026, FamousSparrow had been specializing in targets in Latin America. This represents a shift from its earlier world focusing on. To go together with this modification, the group has developed SparroWocky, which changed SparrowDoor as its principal implant. Whereas it doesn’t look like based mostly on the identical codebase, we are able to see that SparroWocky nonetheless shares among the performance and ideas that have been current within the group’s earlier backdoor, which we analyzed in our earlier blogpost. SparroWocky makes use of extra advanced protection evasion strategies to remain beneath the radar.

FamousSparrow nonetheless makes use of open-source offensive tooling for its personal malicious ends. Beforehand, these instruments have been primarily used facet by facet with the group’s backdoor. With SparroWocky, we are able to observe that it additionally has the event capabilities to combine open-source code instantly into its personal customized backdoor.

For any inquiries about our analysis revealed on WeLiveSecurity, please contact us at threatintel@eset.com. 

ESET Analysis affords non-public APT intelligence stories and information feeds. For any inquiries about this service, go to the ESET Menace Intelligence web page.

IoCs

A complete checklist of indicators of compromise (IoCs) and samples might be present in our GitHub repository.

Recordsdata

Community

MITRE ATT&CK strategies

This desk was constructed utilizing model 19 of the MITRE ATT&CK framework.