ESET Analysis’s ongoing monitoring of FamousSparrow has borne fruit as soon as once more. Our earlier public report on FamousSparrow revealed that this China-aligned APT group had developed two new variations of its customized backdoor named SparrowDoor. This time, we found that FamousSparrow has switched to a brand new backdoor, SparroWocky, and has been deploying it to a number of nations in Latin America since not less than August 2025.
In what was most likely China’s response to the US exhibiting elevated curiosity in Latin America, FamousSparrow elevated its concentrating on of the area to nearly completely concentrating on it in July 2025. A month later, we seen that the group had began utilizing the brand new SparroWocky backdoor, which then rapidly changed SparrowDoor as FamousSparrow’s foremost implant.
SparroWocky is a modular, C++ backdoor. Its structure and the methods utilized by its authors point out sturdy data of anti-analysis tips and Home windows internals. We selected to call the backdoor SparroWocky as a result of the primary samples we collected all include the primary stanza of Jabberwocky, a nonsense poem by Lewis Carroll. Happily, whereas superior, SparroWocky’s inside workings are a lot much less arcane than a gyre and gimble within the wabe, so a by way of and thru [of] the vorpal blade allowed us to carry you an in depth evaluation of the backdoor.
Key factors of the blogpost:
- FamousSparrow is extensively concentrating on governmental organizations in Latin America.
- Since August 2025, the group seems to be abandoning SparrowDoor in favor of SparroWocky, a brand new customized C++ backdoor.
- With the change to SparroWocky, FamousSparrow began to include code from open-source tasks straight into its malware.
- SparroWocky is a full-featured backdoor that manipulates low-level buildings in reminiscence, and patches code at runtime with a purpose to keep away from detection.
- SparroWocky has the aptitude to load and execute Beacon Object Recordsdata, a particular kind of executable file supported by many red-teaming and penetration-testing instruments.
FamousSparrow is a China-aligned cyberespionage group believed to have been lively since not less than 2019. We first publicly documented the group in a blogpost from September 2021 once we noticed it exploiting the ProxyLogon vulnerability. The group was initially recognized for concentrating on motels around the globe however has additionally focused governments, worldwide organizations, commerce teams, engineering firms, and regulation companies. FamousSparrow is the one recognized person of the SparrowDoor backdoor.
We analyzed two variations of SparrowDoor in a 2025 blogpost, by which we additionally mentioned the attribution claims across the group. As talked about by Pattern Micro, FamousSparrow is linked to Earth Estries; nonetheless, the precise nature of the hyperlink just isn’t absolutely recognized. FamousSparrow has additionally been publicly linked to Salt Hurricane, however, because of the absence of any technical indicators, we monitor them as separate.
Primarily based on our investigation, we attribute the newest marketing campaign and the SparroWocky backdoor to FamousSparrow with excessive confidence, since in a number of the first assaults involving this backdoor, SparroWocky was deployed by the FamousSparrow-exclusive SparrowDoor. Furthermore, not solely does the victimology match FamousSparrow’s earlier concentrating on, we’ve additionally recorded makes an attempt to deploy SparroWocky at lots of the similar organizations that had beforehand been focused with SparrowDoor.
Latin America within the crosshairs
As beforehand talked about, FamousSparrow presently seems to be targeted on high-profile targets in Latin America. This development began on the newest in July 2025 and has continued with the introduction of SparroWocky. In truth, from mid-2025 and into 2026, 90% of the group’s targets registered in our telemetry have been situated within the area. As depicted in Determine 1, we’ve seen the brand new backdoor deployed in opposition to governmental entities in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela. This represents a uncommon prevalence among the many China-aligned APT teams that we presently monitor, that are typically noticed all through varied world areas inside such an prolonged time-frame.
We imagine that this focus just isn’t coincidental and sure displays China’s response to varied current US initiatives within the area. Certainly, Donald Trump’s second presidential time period has caused an aggressive reaffirmation of US pursuits in Latin America, which threatens varied long-term investments that China has cultivated all through the continent within the final decade, in domains similar to vitality, mining, and telecommunications. We suspect that FamousSparrow’s actions are meant to assist China higher monitor and anticipate the response of native governments to present US pressures.
In some instances, we’ve noticed parts that clearly appear to verify this speculation. As an example, one of many Panamanian entities we’ve seen being focused is straight concerned within the ongoing business dispute relating to two main ports situated within the canal space, which have been, till not too long ago, operated by a China-based firm. Because the concession granted to this firm was legally challenged by the Panamanian authorities in early 2025, it appears extremely seemingly that FamousSparrow’s operation was meant to realize early, privileged data of native authorities’ intentions on this challenge.
It’s not clear whether or not the group’s obvious give attention to Latin America could mirror a proper, geographical mandate, or whether or not this focus is simply non permanent and dictated by the present geopolitical circumstances.
Analyzing SparroWocky
SparroWocky is a full-featured, modular C++ backdoor constructed with modularity and stealthiness in thoughts. It appeared shortly after FamousSparrow began specializing in Latin America and rapidly turned the group’s new flagship implant, changing SparrowDoor. It must be famous that SparroWocky just isn’t a variant of SparrowDoor, however is moderately a definite malware household. The transition to this new backdoor additionally got here with a better degree of integration of open-source tooling into FamousSparrow’s workflow: whereas beforehand, standalone variations of those instruments have been deployed aspect by aspect with SparrowDoor, with SparroWocky, some have been included straight into the malware.
A few of SparroWocky’s notable options embrace the flexibility to execute arbitrary information, to behave as a TCP proxy, and to execute instructions. The backdoor additionally collects common details about the compromised machine, similar to the pc identify, the username, area identify, Home windows model, and the IP addresses of its community interfaces. SparroWocky can be able to exfiltrating information and taking screenshots periodically. Exfiltrated info is encrypted utilizing RC4 and despatched over the TLS protocol.
Relying on its configuration, SparroWocky can set up persistence both by making a devoted service or an entry in a registry Run key.
Loader
SparroWocky is deployed utilizing the widespread trident loader scheme, which consists of a official executable, a malicious DLL standing in for one required by that executable, and a file containing an encrypted payload (see Determine 2). The loader resides within the aforementioned DLL and is executed through DLL side-loading. We now have seen FamousSparrow use a variety of side-loading targets; generally, a patched model of the official DLL that the executable is meant to load. Whereas a lot of the file is left untouched, an arbitrary portion of the .textual content part is changed with the malicious code, and the entry level header is modified to level inside this patched area.
This has some defense-evasion properties: having the metadata and exported operate checklist of the malicious DLL be the identical as that of the official model permits it to extra simply mix in. Because the code within the patched area doesn’t align with the exported features and calls within the untouched portion, automated evaluation instruments could have bother recognizing operate boundaries.
The loader’s foremost position is to extract and decrypt its payload from a file. These information, which usually have the identical identify because the executable however with a .dat extension, have a selected construction detailed in Determine 3. The file has a customized header that begins with a four-byte magic worth of 0x11328712, adopted by the dimensions of the configuration knowledge, the dimensions of the payload, and a 16-byte RC4 key. This RC4 key’s used to decrypt the rest of the file, which accommodates the configuration for SparroWocky (detailed within the Configuration part) and the backdoor itself. We offer a script to decrypt SparroWocky payload information in our GitHub repository.
The plaintext backdoor payload is formatted as a conveyable executable (PE) file with the MZ and PE magic values deleted. This executable payload is reflectively mapped straight into reminiscence with out being written to disk. Thus, we imagine that stripping these magic values is probably an try and evade in-memory protection mechanisms that use easy sample recognition to establish or dump suspicious sections of reminiscence.
SparroWocky
Our evaluation of SparroWocky is especially based mostly on a pattern compiled on November 17th, 2025 in accordance with its PE timestamp (SHA-1: 44F0A22B143B79FA760BF31E14C8FFF714C8A2A1). The model of this backdoor seems to be 1.8, based mostly on the knowledge collected by its fingerprint command defined in Desk 3.
As we already talked about, we selected the identify SparroWocky as a result of we discovered the primary stanza of Lewis Caroll’s Jabberwocky in a number of samples we collected. We imagine that this stanza comes from the take a look at vectors in RFC 7539, which defines the ChaCha20-Poly1305 encryption algorithm. The samples of SparroWocky additionally include different strings which can be used as take a look at vectors in that RFC. Nevertheless, SparroWocky doesn’t use ChaCha20-Poly1305. Whereas we don’t know the precise model of Mbed TLS used within the backdoor, the take a look at vectors have been current in that library previous to model 4.0.0.
Notably, SparroWocky depends not less than on the next public tasks:
- Mbed TLS, a C library it makes use of to determine a safe communication channel with its C&C server,
- MinHook, a Home windows API hooking library it makes use of to cover the beginning handle of newly created threads from safety merchandise, and
- COFF Loader (or an analogous venture) that it makes use of to allow dynamic loading and execution of in-memory plugins within the type of COFF objects.
Moreover, our evaluation revealed that the builders applied varied methods to evade monitoring instruments. This features a variant of a way known as SilentMoonwalk (or StackMoonwalk), which permits SparroWocky to spoof the decision stacks originating from MinHook routines. The backdoor additionally makes use of a customized API-hashing algorithm to dynamically resolve Home windows API features. These are defined in better element within the Anti-analysis methods part.
Configuration
The SparroWocky loader extracts and decrypts its configuration from the payload .dat file situated in the identical listing, as defined within the Loader part. The RC4 key saved within the payload header is used to decrypt the configuration, which is supplied within the type of a tab-separated string that’s then parsed and saved in a construction. The fields and their values are described in Desk 1 so as of look.
Desk 1. SparroWocky configuration
| Discipline | Worth | Extra particulars |
| C&C IP handle | 216.238.110[.]120 | Â |
| C&C port quantity | 443 | Â |
| Connection retry delay (in seconds) | 10 | After the primary retry, the worth is randomized. |
| Proxy connection kind | 0 | 0: If enabled, use the proxy configured on the system; in any other case, join straight. 1: HTTP proxy through Negotiate or Fundamental authentication. 2: SOCKS5 proxy through Fundamental authentication or with out authentication. |
| Proxy IP handle | N/A | Â |
| Proxy port quantity | N/A | Â |
| Proxy username | N/A | Â |
| Proxy password | N/A | Â |
| Persistence methodology | 1 | 1: Service persistence. 2: Registry persistence. |
| Service persistence: service identify | ProcAuditManager | Within the configurations we’ve extracted, the show identify is all the time the identical because the service identify. These normally match the filename of the payload file. |
| Service persistence: show identify | ProcAuditManager | |
| Service persistence: service description | Tracks course of creation, |
 |
| Registry persistence: registry worth | SnapCart | Â |
| Registry persistence: registry key | SOFTWAREMicrosoftWindo |
Makes use of HKLM or HKCU relying on privileges. |
Capabilities
Argument-controlled conduct
After parsing its configuration, the backdoor checks the command line of the method by which it’s working and behaves otherwise based mostly on the quantity and worth of the arguments handed. If no arguments are current, SparroWocky merely units up persistence and executes the core logic of the backdoor. In any other case, the worth of the primary argument directs the malware to comply with particular directions, as described in Desk 2.
Desk 2. SparroWocky command line arguments and their that means
| Argument | Habits | Description |
| c | Load and execute a PE file in reminiscence for a specified period of time earlier than termination. | Utilized in tandem with command 0x16*, SparroWocky reads a command string, an execution timeout delay, and the physique of a PE file from customary enter (stdin). It then masses the desired executable into reminiscence and executes it with the given command. |
| p | Sleep for 5 seconds, arrange persistence, and run the core logic of the backdoor. | Â |
| s | Run the core logic of the backdoor with out establishing persistence. | Utilized in tandem with command 0x2F*, this argument additionally means the backdoor was run as a selected person (through CreateProcessAsUser), recognized by a session ID that was retrieved by command 0x2E*. |
| s2 | Begin a brand new occasion of the backdoor with argument p and terminate. | This argument signifies that the backdoor was began through the service persistence. |
| t | Set the method working listing to the backdoor location and run the core logic of the backdoor. | Â |
* Defined within the Backdoor instructions part.
When SparroWocky is executed with the c possibility, it reads an extra comma-separated checklist of parameters from customary enter (stdin):
- a command string,
- a timeout delay (in seconds), and
- optionally, the physique of a PE file.
If this final parameter is absent, the backdoor reads the executable specified within the command string from C:WindowsSystem32 and masses the related English MUI (Multilingual Consumer Interface) file (from C:WindowsSystem32en-US). This course of is described within the Host course of camouflage for dynamically loaded PEs part. In any other case, the PE file is executed by SparroWocky’s reflective loader, and the command string is handed as a command line. This performance is probably going meant to permit the backdoor to simply execute system utilities.
SparroWocky masses the desired executable into reminiscence and executes it with the supplied command. On the similar time, the backdoor creates a brand new thread that calls ExitProcess to kill the method when the timeout delay expires. The loading course of includes organising hooks and forging buildings in reminiscence to camouflage the host course of earlier than working the goal executable. These anti-analysis tips are defined in better element within the devoted Host course of camouflage for dynamically loaded PEs part.
Moreover, when the malware is executed with out arguments or with the p possibility, an occasion synchronization mechanism is began. This function prevents a number of cases of the backdoor from working concurrently by leveraging a customized interprocess communication (IPC) mechanism. When a brand new occasion is launched, the presently working occasion stops and, if the brand new occasion is launched from a unique location than the present one, the information and persistence configurations set by the presently working occasion are deleted. That is achieved through the use of three kinds of world objects: a mutex, an occasion, and a shared reminiscence block named MyMutexName, MyEventName, and MySharedMemName, respectively.
Backdoor instructions
The backdoor first establishes communication with its C&C server, then executes its core logic in an infinite loop, inside which it processes obtained instructions. These are dealt with by a customized class named WinHandler (derived from a ServerHandler customized class), in accordance with the runtime kind info (RTTI) current within the malware. Handlers for a minimal set of instructions are hardcoded within the command loop itself. ServerHandler has a devoted digital methodology to deal with extra instructions. This methodology is applied in WinHandler. Whereas we’ve not noticed different implementations of this methodology, this structure would make it straightforward for its builders to vary the set of instructions that the backdoor can deal with. The checklist of supported instructions is proven in Desk 3.
Desk 3. SparroWocky instructions
| ID | Arguments | Description |
| 0x10 | N/A | Collects and sends the next system info: · MD5 hash of the machine GUID, · SparroWocky PID, · hostname, · IP addresses of all community interfaces, · username, · Home windows product identify, · backdoor model (1.8), · x64 (seemingly backdoor structure), · area identify, · SparroWocky’s host file path, · connection retry delay, and · self-deletion allow state (0 or 1). |
| 0x11* | N/A | Begins a brand new interactive session. Establishes a brand new connection to the C&C server, sends an preliminary packet containing the byte sequence 44 33 22 11 (hex), after which begins processing obtained instructions in a separate thread. |
| 0x12 | N/A | Terminates by calling ExitProcess. |
| 0x13 | N/A | Removes persistence then terminates by calling ExitProcess. |
| 0x14 | Masses a Beacon Object File in reminiscence and calls See beneath for extra particulars. |
|
| 0x16 | Executes the supplied PE file by spawning a brand new SparroWocky course of with the c parameter and customary I/O and error streams redirected to the pipe .pipeccpipe. The arguments are written to the brand new course of’s stdin, then the output of the brand new course of is learn and despatched to the C&C server. | |
| 0x17 | Executes |
|
| 0x1A* | Connects to the supplied IP handle (through TCP/IP) and creates a thread to ahead the site visitors between the distant machine and the C&C server. The completion standing is distributed to the C&C server. | |
| 0x1B | String of semicolon-separated values beginning with two unknown values adopted by the IP handle and port quantity on which to pay attention | Internally named PortmapReverseServer, it accepts TCP connections and forwards site visitors to the C&C server. For every accepted connection, a brand new connection to the C&C server is established and a primary packet is distributed containing the byte sequence 13 12 11 09 (hex). The listener code then sends the machine GUID adopted by the obtained arguments and the checklist of connections opened to date. The code proceeds to deal with the forwarding of the site visitors between the distant machine and the C&C server. |
| 0x1C | Identical as 0x1B | Closes the PortmapReverseServer connection specified by the supplied IP handle and port. The checklist of remaining open connections is distributed to the C&C server. |
| 0x1D | N/A | Returns a listing of all PortmapReverseServer connections to the C&C server. |
| 0x1E | Path to the brand new working listing | Units the desired present working listing and returns the CWD to the C&C server. |
| 0x1F | N/A | Returns the present working listing to the C&C server. |
| 0x20 | Path to the goal listing | Creates the desired listing, sending the completion standing to the C&C server. |
| 0x21 | N/A | Returns the checklist of logical drives and their kind to the C&C server. |
| 0x22 | Path to the goal listing | Returns a listing of the contents of the desired listing, their sizes and last-write occasions, collected through FindFirstFileW. |
| 0x23 | Path of the file to delete | Deletes the desired file and returns the completion standing. |
| 0x24 | Supply and vacation spot paths | Copies the desired file to the desired location and returns the completion standing. |
| 0x25 | Supply and vacation spot paths | Strikes the desired file to the desired location and returns the completion standing. |
| 0x26 | Path of the file to rename and the specified new identify | Renames the desired file to the desired new identify and returns the completion standing. |
| 0x27* | File offset and goal file path | Sends the file dimension, creation, final entry, and final write timestamps, and the contents of the desired file, learn from the desired offset in chunks of 4,096 bytes. |
| 0x28* | Goal file path to put in writing to | Sends the present dimension of the desired file then receives the extra file contents in 4,096-byte chunks, appending them to the goal file in a loop. |
| 0x29 | N/A | Enumerates show gadgets and related settings, returning for every lively show gadget: · gadget identify, · whether or not it’s the foremost show, · width (pixels), and · top (pixels). |
| 0x2A | Show gadget identify | Takes a screenshot periodically by sending an preliminary JPG screenshot with its dimensions (width and top) through command ID 0x2C. Each 500Â ms, if no new instructions are obtained, a brand new screenshot is taken, and the distinction from the earlier screenshot is distributed to the C&C server. Modified blocks of pixels in these subsequent screenshots are despatched together with coordinates (x, y) and dimensions through command ID 0x2D. |
| 0x2E | N/A | Returns session IDs and usernames of enumerated distant classes on the system, collected through WTSEnumerateSessionsW. |
| 0x2F | Session ID of the goal person session (retrieved through command 0x2E) | Spawns a brand new occasion of SparroWocky (with possibility s) by duplicating the token related to the desired session ID and calling CreateProcessAsUserW. |
| 0x30 0x31 |
N/A | Echoes the command ID again to the C&C server. |
| 0x33 | Executes |
* Hardcoded command.
Command 0x14 makes use of a barely modified model of RunCOFF from the open-source COFF Loader venture to load and execute a Beacon Object File (BOF). A BOF is a position-independent Frequent Object File Format (COFF) executable that’s meant to be run throughout the reminiscence of an implant. BOFs have been first launched in Cobalt Strike and have since been adopted by different well-liked red-teaming frameworks similar to Brute Ratel, Metasploit, and Sliver. The change to RunCOFF resides within the decision of imported symbols. SparroWocky redirects calls to exterior libraries within the BOF to a stack-spoofing subroutine. This successfully hides and proxies calls made by the BOF object. As soon as the item is loaded, the BOF loader finds and executes function_name, passing the arguments supplied in function_arguments. The flexibility to load BOFs permits FamousSparrow to make use of present modules and instruments designed to work with this file kind.
Self-deletion
As described within the Argument-controlled conduct part, SparroWocky can delete itself totally from the system. This may be achieved from the C&C server through command 0x13. First, the persistence mechanism beforehand set is eliminated after which the batch file proven in Determine 4 is created and executed.
@echo off
timeout /t 2
del "" /f /q
del "" /f /q
del "" /f /q
del "%%0" /f /qn Determine 4. Batch file for self-deletion
This deletes the information utilized by the backdoor: the official executable, the side-loading library, and the payload file. The batch file deletes itself on the finish of the script.
Anti-analysis methods
SparroWocky employs a number of methods to complicate its evaluation and to evade safety software program that could be in place. A standard method that the backdoor makes use of is dynamic API decision through API hashing, however the backdoor additionally makes use of extra attention-grabbing ones, described beneath.
SilentMoonwalk
The primary noteworthy method known as SilentMoonwalk, which primarily offers a strategy to forge faux name stacks. Its goal is to stop evaluation instruments and merchandise from inspecting the true caller of particular features which can be incessantly monitored, similar to Home windows API features. This methodology requires a number of initialization steps:
- Discovering the offset of RtlUserThreadStart and BaseThreadInitThunk, two features which can be normally discovered at the beginning (or backside) of any name stack.
- Discovering a JOP (jump-oriented programming) and a ROP (return-oriented programming) gadget within the official kernel32.dll library to revive the unique name stack.
As soon as these necessities are met, when SparroWocky makes an obfuscated name to a Home windows API operate, it first saves the present context (registers); subsequent, it forges a faux stack utilizing the devices discovered beforehand, after which inserts the handle of a stack and context restoration routine. This makes it seem as if the calls to Home windows API features are originating from RtlUserThreadStart and BaseThreadInitThunk. Determine 5 reveals the decision stack view from a debugging session utilizing WinDbg.
Within the case of SparroWocky, this system is used to obfuscate calls made by BOF-formatted plugins (command 0x14) or by the statically linked MinHook hooking library.
Concealing the thread begin handle
SparroWocky makes use of the MinHook library to hook the CreateThread operate with a purpose to conceal the unique lpStartAddress parameter from safety merchandise. Basically, any thread created by SparroWocky would have AnimateWindow because the beginning handle, which might seemingly be thought-about official by a safety product. The patch utilized to AnimateWindow turns it right into a trampoline that merely executes the unique begin handle, as illustrated in Determine 6.
Host course of camouflage for dynamically loaded PEs
The final notable piece of code from SparroWocky is its customized PE loader, used when executed with possibility c. Whereas implementing PE loaders is just about routine for malware authors, SparroWocky authors took it a step additional and built-in host course of camouflage.
As described in Desk 2, when SparroWocky is executed with the c possibility, it masses a PE file in reminiscence and executes it. If the file just isn’t handed as an argument, the PE loader parses the desired command line to extract the file’s identify. It searches for that filename within the C:WindowsSystem32 listing, however most significantly it retrieves the English localization MUI file related to the goal PE (saved as C:WindowsSystem32en-US
The command line retrieved from Stdin is parsed and SparroWocky hooks the next features, that are used to retrieve details about command line arguments, to make them level to this command line:
- GetCommandline[AW]
- __(w}getmainargs
- __p___argc
- __p___{w}argv
The PE loader can be in a position to register the exception handlers of the newly loaded executable – an uncommon, but crucial, addition – because it permits exceptions to be dealt with accurately.
Lastly, earlier than calling the entry level of the loaded PE file, SparroWocky forges and inserts a faux LDR_DATA_TABLE_ENTRY construction within the doubly linked checklist of the PEB_LDR_DATA construction. This doubly linked checklist is utilized by Home windows to maintain monitor of loaded modules and is normally monitored by safety merchandise. Determine 7 reveals a snippet of the code used to set a few of its fields.
This final method reveals that SparroWocky authors possess a deep understanding of the Home windows PE loading mechanism and are keen to go the additional mile to camouflage the host course of and confuse monitoring software program.
Community protocol
To speak with its C&C server, SparroWocky makes use of the TLS encryption protocol. Underneath the hood, the backdoor makes use of the Mbed TLS library and the one ingredient value mentioning is that it makes use of the personalization string acdbenus when initializing the deterministic random bit generator, as seen in Determine 8.
Earlier than the preliminary TLS handshake, a TCP connection is established with the C&C server utilizing one in every of three connection modes:
A connection mode of 0 implies that SparroWocky makes use of the proxy presently configured on the machine or a direct TCP connection if no system proxy is configured. This configuration is retrieved by querying the ProxyServer registry worth situated below the registry key HKCUSoftwareMicrosoftWindowsCurrentVersionInternet Settings. If the connection to the proxy server just isn’t profitable, SparroWocky tries to attach through mode 1, then mode 2.
Connection mode 1 represents a connection through an HTTP proxy. This connection makes use of both the Negotiate (Kerberos or NTLM) or Fundamental authentication scheme with the username and password supplied within the configuration. Each authentication strategies use generic HTTP headers with the Consumer-Agent string set to Mozilla/5.0.
Connection mode 2 makes use of a SOCKS5 proxy with out authentication (AUTH subject set to 0x00) or with a username and password (AUTH subject set to 0x02). The values utilized by the latter are supplied within the configuration.
Command messages
As soon as the TLS handshake is full, SparroWocky sends the bytes 0x11223344 (big-endian) to point that it is able to obtain instructions in the principle session. The backdoor makes use of a easy format to obtain instructions and ship outcomes, as illustrated in Determine 9.
If the command_arg_size subject doesn’t equal 0, then extra knowledge is to be obtained or despatched after the header. In that case, the information (command arguments or outcomes) is encrypted through RC4, and every command message makes use of a newly generated eight-byte key, which is distributed within the header.
Community infrastructure
SparroWocky makes use of the IP handle of its C&C servers, which is usually working on port 443, to attach straight. We now have additionally seen it working on port 8080 in some instances. Whereas we’ve noticed some self-signed certificates being reused throughout a number of servers, we should not have a dependable generic fingerprint.
Conclusion
Over the latter half of 2025 and the primary half of 2026, FamousSparrow had been specializing in targets in Latin America. This represents a shift from its earlier world concentrating on. To associate with this transformation, the group has developed SparroWocky, which changed SparrowDoor as its foremost implant. Whereas it doesn’t seem like based mostly on the identical codebase, we are able to see that SparroWocky nonetheless shares a number of the performance and ideas that have been current within the group’s earlier backdoor, which we analyzed in our earlier blogpost. SparroWocky makes use of extra advanced protection evasion methods to remain below the radar.
FamousSparrow nonetheless makes use of open-source offensive tooling for its personal malicious ends. Beforehand, these instruments have been primarily used aspect by aspect with the group’s backdoor. With SparroWocky, we are able to observe that it additionally has the event capabilities to combine open-source code straight into its personal customized backdoor.
For any inquiries about our analysis printed on WeLiveSecurity, please contact us at threatintel@eset.com.ÂESET Analysis provides non-public APT intelligence stories and knowledge feeds. For any inquiries about this service, go to the ESET Menace Intelligence web page.
IoCs
A complete checklist of indicators of compromise (IoCs) and samples will be present in our GitHub repository.
Recordsdata
| SHA-1 | Filename | Detection | Description |
| 3209689E509205CCDB7E |
winfsp-x64.dll | Win64/Agent.HUP | SparroWocky loader. |
| 52C6646759CF6037BB17 |
winfsp-x64.dll | Win64/Agent.HUP | SparroWocky loader. |
| 99E7070B5AF24A0FE1E6 |
DukeQt.dll | Win64/Agent.ISF | SparroWocky loader. |
| 44F0A22B143B79FA760B |
N/A (in-memory) | Win64/Agent.ASW | SparroWocky backdoor. |
| 9AA9FF61BC63CCAB907 |
N/A (in-memory) | Win64/Agent.ASW | SparroWocky backdoor. |
Community
| IP | Area | Internet hosting supplier | First seen | Particulars |
| 38.54.57[.]17 | N/A | LightNode‑BR | 2026‑02‑25 | SparroWocky C&C server. |
| 38.60.197[.]55 | N/A | Kaopu Cloud HK Restricted | 2026‑03‑16 | SparroWocky C&C server. |
| 38.60.209[.]106 | N/A | Kaopu Cloud HK Restricted | 2026‑02‑26 | SparroWocky C&C server. |
| 38.60.224[.]51 | N/A | Kaopu Cloud HK Restricted | 2026‑02‑25 | SparroWocky C&C server. |
| 38.60.224[.]235 | N/A | Kaopu Cloud HK Restricted | 2026‑02‑24 | SparroWocky C&C server. |
| 38.60.241[.]65 | N/A | Cogent Communications | 2026‑03‑10 | SparroWocky C&C server. |
| 38.60.241[.]127 | N/A | Cogent Communications | 2026‑03‑04 | SparroWocky C&C server. |
| 38.60.241[.]193 | N/A | KaopuCloud‑BR | 2026‑01‑22 | SparroWocky C&C server. |
| 77.111.101[.]40 | N/A | Latitude.sh | 2026‑05‑20 | SparroWocky C&C server. |
| 91.148.134[.]115 | N/A | Charles‑R Paquet | 2026‑06‑17 | SparroWocky C&C server. |
| 130.94.101[.]82 | N/A | NTT America, Inc. | 2026‑02‑26 | SparroWocky C&C server. |
| 140.99.164[.]199 | N/A | Non-public Buyer | 2026‑02‑26 | SparroWocky C&C server. |
| 149.104.87[.]228 | N/A | Lightnode‑MX | 2026‑02‑24 | SparroWocky C&C server. |
| 149.104.90[.]203 | N/A | BEDGE CO LIMITED | 2026‑01‑22 | SparroWocky C&C server. |
| 216.238.92[.]2 | N/A | The Fixed Firm, LLC | 2026‑02‑25 | SparroWocky C&C server. |
| 216.238.105[.]53 | N/A | The Fixed Firm, LLC | 2026‑01‑22 | SparroWocky C&C server. |
| 216.238.110[.]120 | N/A | The Fixed Firm, LLC | 2025‑12‑11 | SparroWocky C&C server. |
| 216.238.121[.]164 | N/A | The Fixed Firm, LLC | 2026‑03‑16 | SparroWocky C&C server. |
MITRE ATT&CK methods
This desk was constructed utilizing model 19 of the MITRE ATT&CK framework.
| Tactic | ID | Identify | Description |
| Useful resource Improvement | T1583.003 | Purchase Infrastructure: Digital Non-public Server | FamousSparrow has acquired servers to make use of for C&C and supply servers for SparroWocky. |
| T1587.001 | Develop Capabilities: Malware | FamousSparrow has developed SparroWocky and its loader. | |
| T1608.001 | Stage Capabilities: Add Malware | FamousSparrow has uploaded the SparroWocky trident loader to attacker-controlled supply servers. | |
| Preliminary Entry | T1190 | Exploit Public-Dealing with Software | FamousSparrow gained entry to targets’ networks by exploiting publicly reachable Trade servers. |
| Execution | T1059.003 | Command and Scripting Interpreter: Home windows Command Shell | SparroWocky has performance to run instructions through the Home windows command shell. |
| T1569.002 | System Companies: Service Execution | When establishing persistence through a service, SparroWocky begins the service straight. | |
| T1106 | Native API | SparroWocky makes use of the native Home windows API. | |
| T1559 | Inter-Course of Communication | SparroWocky makes use of an interprocess communication mechanism to synchronize cases when a brand new one is launched. | |
| T1574.001 | Hijack Execution Stream: DLL | The SparroWocky loader is executed through DLL side-loading. | |
| Persistence | T1547.001 | Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder | SparroWocky can persist through a registry Run key. |
| T1543.003 | Create or Modify System Course of: Home windows Service | SparroWocky can persist through a Home windows service. | |
| Stealth | T1134.002 | Entry Token Manipulation: Create Course of with Token | SparroWocky can create processes utilizing a token obtained from any present person session. |
| T1140 | Deobfuscate/Decode Recordsdata or Info | SparroWocky’s loader retrieves the configuration and payload through RC4 decryption of the content material of a file with a customized format. | |
| T1480.002 | Execution Guardrails: Mutual Exclusion | SparroWocky makes use of a mutex to stop a number of cases from working concurrently. | |
| T1564.010 | Disguise Artifacts: Course of Argument Spoofing | When loading an exterior PE file, SparroWocky hooks features to retrieve its command line arguments from stdin. | |
| T1027.007 | Obfuscated Recordsdata or Info: Dynamic API Decision | SparroWocky makes use of a customized API hashing algorithm to dynamically resolve API features at runtime. | |
| T1620 | Reflective Code Loading | The SparroWocky reflectively masses its payload into reminiscence. SparroWocky can reflectively load and execute PE and BOF objects. | |
| T1070.004 | Indicator Removing: File Deletion | SparroWocky can delete itself from the compromised machine. | |
| T1070.009 | Indicator Removing: Clear Persistence | SparroWocky can take away its persistence mechanism from the compromised machine. | |
| T1036.001 | Masquerading: Invalid Code Signature | The SparroWocky loader retains the now invalid signature of the official module it’s impersonating. | |
| T1036.004 | Masquerading: Masquerade Activity or Service | SparroWocky makes use of official or generic names and descriptions for its persistence service. | |
| Discovery | T1083 | File and Listing Discovery | SparroWocky can checklist information and directories on mapped drives. |
| T1680 | Native Storage Discovery | SparroWocky can retrieve details about mapped storage gadgets. | |
| T1082 | System Info Discovery | SparroWocky can gather details about the system it’s working on, such because the Home windows model, hostname, and the IP addresses of community interfaces. | |
| T1033 | System Proprietor/Consumer Discovery | SparroWocky can retrieve the username of the present person and of any person with an lively session. | |
| T1120 | Peripheral System Discovery | SparroWocky can retrieve details about related show gadgets. | |
| Assortment | T1005 | Information from Native System | SparroWocky can exfiltrate information from mapped storage. |
| T1113 | Display screen Seize | SparroWocky can periodically seize screenshots. | |
| Command and Management | T1573.002 | Encrypted Channel: Uneven Cryptography | SparroWocky makes use of TLS, which makes use of uneven cryptography in its handshake. |
| T1573.001 | Encrypted Channel: Symmetric Cryptography | SparroWocky makes use of RC4 to encrypt the knowledge it exfiltrates. | |
| T1090.001 | Proxy: Inside Proxy | SparroWocky can proxy connections between the C&C server and one other distant machine. | |
| T1090.002 | Proxy: Exterior Proxy | SparroWocky can use an HTTP or SOCKS5 proxy to connect with its C&C server. | |
| T1095 | Non-Software Layer Protocol | SparroWocky makes use of TLS over TCP to speak with its C&C server. | |
| Exfiltration | T1041 | Exfiltration Over C2 Channel | SparroWocky exfiltrates knowledge by way of the identical connection used to obtain instructions from the C&C server. |
