The backdoor that bites, the commands that catch

ESET Research’s continuous monitoring of FamousSparrow has resulted in new findings. In our previous public report on FamousSparrow, we revealed that this APT group aligned with China had developed two new versions of its custom backdoor named SparrowDoor. However, we have now discovered that FamousSparrow has shifted to a new backdoor called SparroWocky, which has been deployed in several countries in Latin America since at least August 2025.

In response to increased US interest in Latin America, FamousSparrow intensified its targeting of the region in July 2025. Subsequently, the group began utilizing the SparroWocky backdoor a month later, replacing SparrowDoor as its primary implant.

SparroWocky is a modular, C++ backdoor known for its advanced anti-analysis techniques and deep understanding of Windows internals. The backdoor was named SparroWocky due to its initial samples containing the first stanza of Jabberwocky, a poem by Lewis Carroll. Despite its complexity, SparroWocky’s inner workings are comprehensible, allowing us to conduct a detailed analysis of the backdoor.

Key points from the blogpost:

• FamousSparrow is primarily targeting governmental organizations in Latin America.
• Since August 2025, the group has been transitioning from SparrowDoor to the new custom C++ backdoor, SparroWocky.
• With the adoption of SparroWocky, FamousSparrow has started integrating code from open-source projects directly into its malware.
• SparroWocky is a sophisticated backdoor that manipulates low-level memory structures and dynamically patches code to evade detection.
• SparroWocky can load and execute Beacon Object Files, which are supported by various red-teaming and penetration-testing tools.

FamousSparrow, a China-aligned cyberespionage group, has been active since at least 2019. Initially known for targeting hotels worldwide, the group has also focused on governments, international organizations, trade groups, engineering companies, and law firms. FamousSparrow exclusively utilizes the SparrowDoor backdoor.

Our analysis of SparrowDoor versions in a 2025 blogpost also discussed the group’s attribution claims. According to Trend Micro, FamousSparrow is associated with Earth Estries, although the exact nature of this connection remains unclear. Additionally, FamousSparrow has been linked to Salt Typhoon, albeit as distinct entities due to the absence of specific technical indicators.

Based on our investigation, we confidently attribute the latest campaign and the SparroWocky backdoor to FamousSparrow. The deployment of SparroWocky by FamousSparrow-exclusive SparrowDoor in initial attacks, coupled with matching victimology, reinforces our attribution.

Latin America Targeted

FamousSparrow’s current focus on high-profile targets in Latin America began in July 2025 and has continued with the introduction of SparroWocky. From mid-2025 to 2026, 90% of the group’s targets in our telemetry have been located in the region. Figure 1 illustrates the deployment of the new backdoor against governmental entities in various Latin American countries.

This strategic shift likely stems from China’s response to heightened US initiatives in Latin America. FamousSparrow’s operations in the region may serve to monitor and anticipate local governments’ reactions to US pressures, especially amid commercial disputes and geopolitical tensions.

While the group’s emphasis on Latin America may be temporary, driven by current circumstances, it remains unclear if this geographical focus represents a long-term mandate.

Analysis of SparroWocky

SparroWocky, a comprehensive C++ backdoor, prioritizes modularity and stealth. Its emergence coincided with FamousSparrow’s shift towards Latin America, supplanting SparrowDoor as the group’s primary implant. Notably, SparroWocky is a distinct malware family, not a variant of SparrowDoor.

The integration of open-source tools directly into SparroWocky marks a significant evolution in FamousSparrow’s tactics. The backdoor’s functionalities include executing files, acting as a TCP proxy, running commands, gathering system information, exfiltrating files, and capturing screenshots.

The exfiltrated data undergoes encryption using RC4 and is transmitted through the TLS protocol.

SparroWocky can establish persistence by either creating a dedicated service or an entry in a registry Run key, depending on its configuration.

Loader

SparroWocky utilizes the common trident loader scheme, which involves a legitimate executable, a malicious DLL posing as a required DLL for the executable, and a file containing an encrypted payload (refer to Figure 2). The loader is housed within the malicious DLL and is activated through DLL side-loading. FamousSparrow has been observed using various side-loading targets, typically a modified version of the legitimate DLL that the executable is meant to load. This modified DLL retains most of the original file content, with only a part of the .text section replaced by malicious code, and the entry point header adjusted to point within this altered region.

This technique aids in defense evasion as the metadata and exported function list of the malicious DLL match those of the legitimate version, allowing it to blend in seamlessly. The mismatch between the patched code and the original functions in the untouched portion can hinder automated analysis tools in identifying function boundaries.

The primary function of the loader is to decrypt and extract the payload from a file. These files, typically named similarly to the executable but with a .dat extension, follow a specific structure outlined in Figure 3. The file begins with a custom header featuring a four-byte magic value (0x11328712), followed by the sizes of the configuration data and payload, and a 16-byte RC4 key. This RC4 key decrypts the remainder of the file, containing the configuration for SparroWocky (described in the Configuration section) and the backdoor itself. A decryption script for SparroWocky payload files is available in our GitHub repository.

The plaintext backdoor payload is formatted as a portable executable (PE) file with the MZ and PE magic values removed. This executable payload is directly mapped into memory without being written to disk, potentially as an evasion tactic against in-memory defense mechanisms that rely on simple pattern recognition to detect or dump suspicious memory sections.

SparroWocky

Our analysis of SparroWocky is primarily based on a sample compiled on November 17th, 2025, as indicated by its PE timestamp (SHA-1: 44F0A22B143B79FA760BF31E14C8FFF714C8A2A1). The version of this backdoor is presumed to be 1.8, deduced from the information retrieved through its fingerprint command detailed in Table 3.

The name SparroWocky was chosen due to the presence of the first stanza of Lewis Caroll’s Jabberwocky in several samples. This stanza likely originates from the test vectors in RFC 7539, defining the ChaCha20-Poly1305 encryption algorithm. While SparroWocky includes other strings used as test vectors in the RFC, it does not employ ChaCha20-Poly1305. The test vectors were present in versions of Mbed TLS preceding 4.0.0, although the specific version used in the backdoor remains unknown.

Notably, SparroWocky utilizes various public projects, including Mbed TLS for secure communication with its C&C server, MinHook for Windows API hooking to conceal thread start addresses, and COFF Loader (or a similar project) for dynamic loading and execution of in-memory plugins in COFF object format.

Our analysis also uncovered evasion techniques implemented by the developers, such as a variant of SilentMoonwalk (or StackMoonwalk) to obfuscate call stacks from MinHook routines and a custom API hashing algorithm for dynamic resolution of Windows API functions. Further details on these techniques are discussed in the Anti-analysis techniques section.

Configuration

The SparroWocky loader decrypts its configuration from the payload .dat file in the same directory, as elaborated in the Loader section. The RC4 key from the payload header decrypts the configuration, presented as a tab-separated string that is parsed and stored in a structured format. Table 1 outlines the configuration fields and their corresponding values.

Table 1. SparroWocky configuration

Capabilities

Argument-controlled behavior

Upon analyzing its configuration, the backdoor scrutinizes the command line of the process it is currently running in and exhibits varied behavior based on the number and content of the arguments provided. If no arguments are detected, SparroWocky proceeds to establish persistence and execute the core operations of the backdoor. Conversely, if arguments are present, the first argument’s value dictates specific actions for the malware to undertake, as outlined in Table 2.

Table 2. SparroWocky command line arguments and their interpretations

* Further elaborated in the Backdoor commands section.

When SparroWocky is executed with the c option, it retrieves an additional comma-separated series of parameters from standard input (stdin):

• a command string,
• a timeout delay (in seconds), and
• optionally, the body of a PE file.

In the absence of the last parameter, the backdoor loads the executable specified in the command string from C:\Windows\System32\ and loads the corresponding English MUI (Multilingual User Interface) file (from C:\Windows\System32\en-US\). Refer to the Host process camouflage for dynamically loaded PEs section for a detailed explanation. Alternatively, the PE file is executed by SparroWocky’s reflective loader, with the command string passed as a command line. This functionality likely facilitates the backdoor’s ability to execute system utilities effortlessly.

SparroWocky loads the specified executable into memory and executes it with the provided command. Simultaneously, the backdoor initiates a new thread that invokes ExitProcess to terminate the process when the timeout delay expires. The loading process entails setting up hooks and manipulating structures in memory to disguise the host process before running the target executable. These evasion techniques are further elucidated in the dedicated Host process camouflage for dynamically loaded PEs section.

Furthermore, when the malware is executed without arguments or with the p option, an instance synchronization mechanism is activated. This functionality prevents multiple instances of the backdoor from running concurrently by leveraging a custom interprocess communication (IPC) mechanism. Upon launching a new instance, the existing instance halts, and if the new instance originates from a different location than the current one, the files and persistence configurations established by the current instance are erased. This mechanism utilizes three global objects: a mutex, an event, and a shared memory block named MyMutexName, MyEventName, and MySharedMemName, respectively.

Backdoor commands

Upon establishing communication with its C&C server, the backdoor executes its core operations in a continuous loop, processing received commands. These commands are managed by a customized class named WinHandler (derived from a ServerHandler custom class) based on the runtime type information (RTTI) present in the malware. Basic commands are hardcoded within the command loop, while ServerHandler features a specialized virtual method for handling additional commands. This method is implemented in WinHandler, offering flexibility for developers to modify the range of commands the backdoor can process. The list of supported commands is detailed in Table 3.

Table 3.