China's Salt Typhoon reportedly backdoors Latin American organizations with SparroWocky malware

The Salt Typhoon group has developed a new backdoor, SparroWocky, which targets high-profile organizations across multiple Latin American countries. This marks a significant shift in their operations, focusing heavily on this region, with 90 percent of their efforts directed there since mid-2025. The deployment of such malware raises concerns for cybersecurity in these countries.

The SparroWocky backdoor uses a sophisticated method involving a trident loader scheme, which allows it to execute malicious code while remaining hidden. Its capabilities include gathering system information, stealing files, and taking screenshots, making it a potent tool for espionage. Understanding its architecture is vital for engineers working on security solutions.

This malware is designed to evade traditional security measures through techniques like API hooking and custom encryption. It communicates with command-and-control servers over standard ports, which may complicate detection efforts. Organizations must assess their defenses to counter such stealthy threats effectively.

The geopolitical context surrounding the deployment of SparroWocky suggests that this malware is not just a technical threat but part of broader strategic actions in response to U.S. policies in Latin America. Cybersecurity teams must consider the implications of state-sponsored threats in their risk assessments and defensive strategies.

ESET's publication of indicators of compromise and malware samples provides a critical resource for organizations to enhance their defenses against this new threat. Continuous monitoring and updating of security protocols will be essential to mitigate the risks posed by this malware and similar future threats.