CyberNew CyberNew
Ransomware & Malware Dark Reading 4 weeks ago

China's FamousSparrow APT Spies on US Politics in Latin America

CN
CyberNew Threat Research Desk
• Original Reporting: Dark Reading
CyberNew Threat Intel Assessment
Assessed Severity: INFORMATIONAL
Impacted Surface
Enterprise Perimeter & Network Defense
Intelligence Sector
Ransomware & Malware

Analyst Takeaway

"A Chinese cyber-espionage group known as " FamousSparrow " is using a revamped backdoor to build a nest inside Central and South American governments and major industries. The advanced persistent threat (APT) is associated with, but not definitively confirmed to be related to, Earth Estries and Salt Typhoon ; it's a seven-year-old outfit that made its reputation by attacking international hotels,..."

Recommended Defense & Mitigation

  • Threat Monitoring: Ingest published IOCs into SIEM/EDR detection rules for continuous telemetry monitoring.
  • Security Awareness: Alert staff and maintain baseline endpoint hardening across endpoints.
Curated & Verified by CyberNew Threat Intelligence Desk Standard Defense Framework (NIST / MITRE ATT&CK)

A Chinese cyber-espionage group known as "FamousSparrow" is using a revamped backdoor to build a nest inside Central and South American governments and major industries.

The advanced persistent threat (APT) is associated with, but not definitively confirmed to be related to, Earth Estries and Salt Typhoon; it's a seven-year-old outfit that made its reputation by attacking international hotels, and governments and corporations here and there. It appears to have changed its modus operandi of late, though, to become China's eyes and ears in the global southwest. Since the summer of 2025, it has been using a custom backdoor called "SparroWocky" to keep an eye on government agencies in the Latin American region, particularly those that host Chinese investments that are currently being scrutinized by the Trump administration.

Chinese Cyberattacks in Latin America

In July 2025, ESET researchers observed FamousSparrow pivot to exclusively targeting government organizations in Latin America. To meet its new challenge, the following month, it ditched its namesake "SparrowDoor" backdoor for the aforementioned SparroWocky malware.

Related:Cyber Op Targets South Korean Media & Automotive Sectors

Source Verification & Original Intelligence

This threat report was reviewed by CyberNew analysts and cross-referenced with primary security disclosures from Dark Reading.

Primary Advisory →