Chinese hackers use SparroWocky malware in govt espionage attacks

China-linked group FamousSparrow has attacked government organizations in Latin America for over a year with a new backdoor, SparroWocky, replacing SparrowDoor. ESET recorded targets in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico and Venezuela, plus 18 C2 addresses.

• SparroWocky is a modular C++ backdoor with open-source code
• Loaded via DLL side-loading and in-memory RC4 payload decryption
• Screenshots every 500 ms, TCP proxy and self-deletion
• Persistence via ProcAuditManager service or SnapCart key