Security1 publisher2 min readPublished
FamousSparrow replaced SparrowDoor with SparroWocky in a year of Latin American intrusions
ESET traced more than a year of espionage against government organizations in eight Latin American countries and territories to a modular C++ implant that hooks CreateThread so every thread it spawns looks like AnimateWindow.
The Watch · Security desk
What happened
- ESET attributes a new backdoor called SparroWocky to the China-linked group FamousSparrow, in attacks on government organizations in Latin America that have run for more than a year.
- The researchers observed the malware against organizations in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico and Venezuela.
- SparroWocky replaces SparrowDoor, the custom backdoor FamousSparrow had been using until now.
- ESET believes the objective was collecting intelligence on how Latin American governments are responding to increasing U.S. pressure on Chinese economic interests.
- At least 18 command-and-control addresses were seen talking to the malware directly over port 443 or 8080, or through HTTP and SOCKS5 proxies.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- constraint Any FamousSparrow coverage keyed to SparrowDoor's loaders, file names and infrastructure is now looking for a tool the group has stopped using, and that hunting work has to be redone against the new indicator set.
- capability The CreateThread hook takes the thread start address away as a triage signal: an analyst or product inspecting a suspicious thread sees AnimateWindow and has no reason to escalate.
- exposure If ESET's read of the motive is right, the collection target is whichever ministries and trade bodies handle U.S.-China policy, and those sit in governments beyond the eight where telemetry caught the implant.
- decision Blocking the published addresses is quick and will not outlast the next rotation, so the choice is whether to fund the endpoint telemetry that would surface a service or registry key by name.
Persistence is the cheapest place to look. SparroWocky installs either as a Windows service named ProcAuditManager or as a registry key named SnapCart under HKLM or HKCU, depending on the privileges it has [13]. Delivery is DLL side-loading. A loader decrypts an RC4-encoded payload held in a .dat file and maps it directly into memory [9]. ESET's account does not describe how the group gets its first foothold on a host.
For anyone triaging threads, the hook is the important part. "SparroWocky uses the MinHook library to hook the CreateThread function in order to conceal the original lpStartAddress parameter from security products," ESET said [11]. "Essentially, any thread created by SparroWocky would have AnimateWindow as the starting address, which would likely be considered legitimate by a security product" [12]. The same build spoofs call stacks and thread origins, resolves APIs dynamically, and disguises its in-memory code and DLLs as legitimate Windows components [10]. It also manipulates low-level structures in memory and patches code at runtime [8].
Screen capture runs every 500 milliseconds, and after the first full-screen image only the changed regions are transmitted [14]. At that interval a compromised desktop yields 7,200 frames an hour [20]. The backdoor also runs commands and executables, loads Beacon Object Files in memory, enumerates drives, files, displays and active user sessions, creates processes in another logged-in user's session, works as a TCP proxy, and can remove its persistence and delete its own files [15].
ESET describes SparroWocky as a modular, full C++ backdoor that reuses code from open-source projects [7]. The researchers said its architecture and evasion techniques "indicate strong knowledge of anti-analysis tricks and Windows internals" [19].
The campaign detail defenders can act on is the tool swap. SparrowDoor, the custom backdoor FamousSparrow used before, has been replaced in these operations [3], so signatures, hunts and network indicators built for that family do not match what is running now. ESET's telemetry puts the group's primary focus on Latin America from mid-2025 [17]. The report carries the technical analysis and a list of indicators of compromise [18].
What to watch
- Whether ESET or another vendor reports SparroWocky outside the eight countries and territories named so far.
- Rotation of the 18 published command-and-control addresses now that they are in a public report.
- Whether the ProcAuditManager service name and SnapCart registry key survive into the next build after publication.