A Chinese state-sponsored advanced persistent threat (APT) group, known as Salt Typhoon, has developed and deployed a new backdoor called SparroWocky against high-profile organizations in Latin America since at least August 2025. This shift in focus to Central and South American targets represents a new strategic direction for the group, which previously targeted telecommunications and government agencies globally.
According to researchers tracking the group, Salt Typhoon, also identified as FamousSparrow, has directed approximately 90 percent of its operations towards Latin America between mid-2025 and 2026. This increased activity in the region is believed to be a response to evolving geopolitical dynamics, specifically the reassertion of US interests in Latin America, which could impact China's long-standing investments in sectors such as energy, mining, and telecommunications. The espionage activities are suspected to provide China with intelligence to monitor and anticipate local governments' reactions to US pressures.
SparroWocky, a modular C++ backdoor, was first detected in August 2025. It has been deployed against government entities in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela. The backdoor is designed to evade detection by security software and incorporates several open-source tools and sophisticated techniques.
The name "SparroWocky" is derived from Lewis Carroll's poem "Jabberwocky," with the first stanza found within several collected malware samples. The backdoor’s compilation date is noted as November 17. Its technical composition includes Mbed TLS, a C library for secure command-and-control (C2) communication, and MinHook, a Windows API hooking library used to conceal newly created thread start addresses from security products.
Additionally, SparroWocky utilizes a COFF Loader, or a similar project, to enable dynamic loading and execution of in-memory plugins as COFF objects. It also integrates a variant of the SilentMoonwalk technique to spoof call stacks originating from MinHook routines, further aiding in evasion. A custom API-hashing algorithm is employed for dynamic resolution of Windows API functions.
The deployment method for SparroWocky follows Salt Typhoon's established "trident loader scheme," which involves a legitimate executable, a malicious DLL, and an encrypted malware file. The malicious DLL contains the loader, which executes via DLL side-loading.
Upon establishing communication with its C2 server, SparroWocky receives commands handled by a custom class named WinHandler, derived from a ServerHandler class. The backdoor supports nearly 30 commands, enabling it to collect system details, initiate and terminate sessions, remove persistence mechanisms, steal and delete files, capture periodic screenshots, gather session IDs and usernames of enumerated remote sessions via WTSEnumerateSessionsW, and spawn new SparroWocky instances.
Communication with C2 servers is encrypted using TLS, typically connecting directly to IP addresses on port 443, though port 8080 has also been observed in some cases. Researchers have published a comprehensive list of indicators of compromise (IoCs) and malware samples in a public GitHub repository.
