Sep 18 – September 20, 2026 · 2 reports
- FamousSparrow has retired SparrowDoor in favour of SparroWocky, a modular C++ backdoor used against Latin American targets since at least August 2025. ESET highlights the tradecraft: MinHook to hide new thread start addresses from EDR, a SilentMoonwalk variant to spoof call stacks from those hooks, a COFF Loader for in-memory plugins, and Mbed TLS for C2 over TLS — open-source offensive code compiled directly into the implant rather than dropped alongside it. The Hacker News, Dark Reading · Sep 20 · observed · as famoussparrow · Threat Activity
- FamousSparrow has replaced SparrowDoor with a new flagship backdoor, SparroWocky, in a campaign ESET has tracked since at least August 2025 against government bodies in seven Latin American countries — Guatemala, Honduras, Puerto Rico, Panama, Venezuela, Peru and Argentina. The backdoor is heavily anti-analysis, borrows from open-source projects, and supports file exfiltration, screenshots and host recon; ESET notes one Panamanian victim is directly involved in the canal ports dispute, and the group has been publicly linked to Salt Typhoon (ESET, The Record). · Sep 18 · observed · as famoussparrow · Threat Activity