Salt Typhoon’s Reported Latin America Focus Includes New SparroWocky Backdoor

SparroWocky deployed against government organizations

ESET, which tracks Salt Typhoon as FamousSparrow, reported that the group deployed SparroWocky from at least August 2025 against government agencies in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela. The modular C++ backdoor is described as using tools and techniques intended to evade security software and as supporting data collection, file theft, screenshots, and remote commands.

Salt Typhoon had been associated with covert, long-term access to telecommunications companies and government agencies, with activity dating back to 2019.

ESET’s analysis says the group shifted its focus to Latin America and deployed a newly identified backdoor, SparroWocky, against government agencies there. It says 90 percent of Salt Typhoon targets from mid-2025 into 2026 were in the region.

The reported change combines a geographic concentration of targeting with a new remote-access malware tool. The report also characterizes the targeting of entities in these countries as unusual among China-aligned advanced persistent threat groups.