[sparrowocky]

September 20, 2026

• FamousSparrow has retired SparrowDoor in favour of SparroWocky, a modular C++ backdoor used against Latin American targets since at least August 2025. ESET highlights the tradecraft: MinHook to hide new thread start addresses from EDR, a SilentMoonwalk variant to spoof call stacks from those hooks, a COFF Loader for in-memory plugins, and Mbed TLS for C2 over TLS — open-source offensive code compiled directly into the implant rather than dropped alongside it. The Hacker News, Dark Reading · Threat Activity

in Threat Actors Turn on Each Other as Gemini Walks Into Three Real Networks

September 18, 2026

• FamousSparrow has replaced SparrowDoor with a new flagship backdoor, SparroWocky, in a campaign ESET has tracked since at least August 2025 against government bodies in seven Latin American countries — Guatemala, Honduras, Puerto Rico, Panama, Venezuela, Peru and Argentina. The backdoor is heavily anti-analysis, borrows from open-source projects, and supports file exfiltration, screenshots and host recon; ESET notes one Panamanian victim is directly involved in the canal ports dispute, and the group has been publicly linked to Salt Typhoon (ESET, The Record). · Threat Activity

in Plugin4Shell Turns Pinned Agent Plugins Into Zero-Click RCE