Chinese FamousSparrow Hackers Deploy SparroWocky Backdoor Across Seven Latin American Governments

ESET researchers identified a sustained Chinese cyberespionage campaign targeting government agencies across Guatemala, Honduras, Puerto Rico, Panama, Venezuela, Peru, and Argentina using a new backdoor malware called SparroWocky. The campaign, attributed to the long-running FamousSparrow group and publicly linked to Salt Typhoon, has been active since at least August 2025 and is focused on Latin America—a rare geographic concentration for Chinese state-backed hacking operations.

The campaign's timing and geography invert the typical Chinese cyber-espionage pattern: FamousSparrow usually operates across multiple regions simultaneously, but here it is concentrated on a single strategic region during a specific U.S. policy offensive. This suggests Beijing is treating Trump's Latin American repositioning as a near-term threat requiring real-time intelligence rather than a long-term competitive advantage requiring broad surveillance. If Panama's port authorities are the primary target, Beijing is trying to understand whether Panamanian leadership will capitulate to U.S. pressure or resist—a binary outcome that determines whether Chinese Belt and Road infrastructure in the Western Hemisphere survives the next 18 months.

WHY IT MATTERS

Trump administration pressure on Chinese port operations in Panama and broader U.S. strategic repositioning in Latin America has triggered a targeted intelligence collection effort designed to anticipate and monitor local government reactions to U.S. coercive measures.

ESET explicitly ties the campaign's regional focus to Beijing's need to track how Latin American governments respond to Trump's disruption of Chinese economic holdings, which means the hacking is not opportunistic espionage but a direct counter to active U.S. policy. Panama is the specific vulnerability: one targeted organization directly manages the canal's two major ports, and Trump has already signaled intent to dislodge Chinese operators—giving Beijing a concrete reason to monitor Panamanian decision-making in real time. Watch whether the State Department or Treasury issues a formal advisory to Latin American governments about the campaign, which would signal the U.S. is treating this as a threshold escalation in cyber-enabled coercion rather than routine espionage.

WHAT THIS DOESN’T TELL US

Has FamousSparrow successfully exfiltrated sensitive data on Panama's port management or lease arrangements, or is the campaign still in reconnaissance phase? ESET's report covers malware capabilities but not confirmed data theft.

Chinese FamousSparrow Hackers Deploy SparroWocky Backdoor Across Seven Latin American Governments

Fault Lines