ESET researchers have published new findings on FamousSparrow, a China-aligned cyberespionage group active since at least 2019, documenting a previously undisclosed backdoor called SparroWocky deployed against government networks across Latin America. The campaign has been running since mid-2025 and shows a known ProxyLogon-era threat actor still getting durable footholds the same way it always has: through internet-facing Microsoft Exchange servers nobody got around to isolating or patching in time.

What happened

FamousSparrow first drew public attention in 2021 when ESET caught it weaponizing the Exchange ProxyLogon vulnerability (CVE-2021-26855) within a day of disclosure, hitting hotels and governments worldwide. The group went quiet for stretches, resurfaced against U.S. and Mexican targets in 2025 with new SparrowDoor variants and its first observed use of the ShadowPad backdoor, and has now shifted its center of gravity almost entirely to Latin America. ESET telemetry shows roughly 90% of FamousSparrow’s targets since mid-2025 sit in the region, with confirmed activity against government entities in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela.

The through-line across four-plus years of activity is initial access: FamousSparrow consistently gets in by exploiting publicly reachable Exchange servers rather than phishing or supply-chain tricks. Once inside, the group has historically dropped Mimikatz, ProcDump, the Nbtscan NetBIOS scanner, and loaders for its custom SparrowDoor backdoor to move laterally and harvest credentials.

The SparroWocky backdoor

SparroWocky is not a SparrowDoor variant — it’s a distinct, modular C++ implant built for stealth, though it inherits some functional overlap with the older tool. Capabilities ESET documented include:

  • Arbitrary file execution and directory listing/manipulation
  • Acting as a TCP proxy for tunneling further access
  • Command execution with results relayed to the operator
  • Host reconnaissance (hostname, username, OS version, domain, NIC IP addresses, machine identifiers)
  • File exfiltration and periodic screenshot capture
  • Self-deletion to remove forensic traces

The evasion tradecraft is the notable part. SparroWocky uses a variant of the SilentMoonwalk technique to forge call stacks (defeating stack-walking detections), MinHook-based manipulation to disguise the start addresses of newly created threads, API hashing to frustrate static analysis, and fabricated Windows loader structures so reflectively loaded code looks legitimate to memory scanners. C2 traffic runs over TLS, predominantly on port 443 with some use of 8080, and command data can be additionally wrapped in RC4. Researchers also found the first stanza of Lewis Carroll’s “Jabberwocky” embedded in early builds — the source of the malware’s name.

Impact

This is a nation-state-grade espionage toolset, not commodity malware, aimed squarely at government networks. ESET assesses the intelligence objective is tracking Latin American governments’ responses to U.S. economic pressure on Chinese interests — meaning targets are chosen for political and economic intelligence value, not opportunistic financial gain. Any organization running a public-facing Exchange server, especially government and diplomatic entities in the region, should treat this as an active targeting signal, not a hypothetical risk.

Mitigation

  • Patch and fully update all internet-facing Exchange servers; unpatched or end-of-life Exchange remains the group’s primary entry point four years after ProxyLogon.
  • Where possible, move Exchange access behind a VPN or reverse proxy with strong authentication rather than exposing OWA/ECP directly to the internet.
  • Hunt for indicators of SilentMoonwalk-style call-stack spoofing and unusual reflectively-loaded modules in memory — these evade standard EDR heuristics built around simpler injection techniques.
  • Monitor outbound TLS traffic on 443/8080 to unfamiliar destinations from Exchange and other internet-facing hosts, and inspect for RC4-wrapped payloads inside otherwise-normal-looking TLS sessions.
  • Audit for known FamousSparrow tooling (Mimikatz, ProcDump, Nbtscan, ShadowPad, SparrowDoor loaders) as a sign of a broader intrusion beyond SparroWocky alone.
  • Government and diplomatic networks in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela should prioritize threat hunting given confirmed targeting.

ESET’s full technical write-up is available via WeLiveSecurity, with additional coverage from The Hacker News.