# China's Salt Typhoon targets Latin America with new SparroWocky malware PRC-backed hackers deploy modular backdoor against governments amid US-China tensions - **Source:** [www.theregister.com - Articles (theregister.co.uk)](https://brifing.si/source/e6d4ec13-4d0e-407a-b96d-39609d76c3b1) - **Published:** 2026-09-17 - **Topic:** [Business](https://brifing.si/c/business) - **Original article:** - **On Brifing:** https://brifing.si/s/0e4015db-05d9-432b-b3ab-ceb07a278f21 ## Geopolitical shift in targeting In August 2025, China's Salt Typhoon hacking group abruptly shifted 90% of its operations to Latin America after previously focusing on telecom and government targets globally. ESET researchers attribute this to China's response to renewed US engagement in the region under President Trump's second term. The group, tracked as FamousSparrow, historically maintained long-term access to victims since 2019, with many breaches only discovered in late 2023. ## New modular backdoor deployed The SparroWocky malware represents a technical evolution, combining open-source tools like Mbed TLS for encrypted C2 communications and MinHook for API hooking. Compiled on November 17, 2025, it incorporates COFF Loader for dynamic plugin execution and SilentMoonwalk stack spoofing to evade detection. The backdoor uses a trident loader scheme involving a legitimate executable, malicious DLL, and encrypted payload for deployment. ## Precision targeting across 8 nations SparroWocky has been deployed against government agencies in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela. ESET notes this regional focus is unusual for China-aligned APT groups, suggesting strategic rather than opportunistic targeting. The malware connects directly to C2 servers via TLS, primarily on port 443, with some instances using port 8080. ## Comprehensive surveillance capabilities The backdoor executes nearly 30 commands through its WinHandler class, including system reconnaissance, file exfiltration, session enumeration via WTSEnumerateSessionsW, and spawning new instances. It periodically captures screenshots and collects remote session details, suggesting focus on monitoring user activity. The malware maintains persistence until explicitly commanded to remove itself. ## Cultural reference in malware Researchers found the first stanza of Lewis Carroll's Jabberwocky poem embedded in multiple samples, marking an unusual characteristic for Chinese state-sponsored malware. This literary reference in SparroWocky's code follows China's APT naming conventions while demonstrating the group's confidence in their operational security. ## Strategic economic motivations ESET analysts connect the attacks to China's need to protect decade-long investments in Latin American energy, mining, and telecom sectors. The surveillance likely aims to anticipate local governments' responses to US pressure. This represents a shift from traditional cyberespionage toward economic intelligence gathering aligned with Belt and Road interests. ## Evasion techniques SparroWocky employs multiple anti-analysis measures including API hashing to dynamically resolve Windows functions, call stack spoofing, and DLL side-loading. These techniques, combined with the use of legitimate open-source projects, complicate detection. The malware's modular design allows for rapid adaptation, with new capabilities potentially added through COFF objects. ## Industry response ESET has published full IoCs and samples on GitHub, enabling network defenders to hunt for SparroWocky activity. The disclosure highlights growing concerns about Chinese cyber operations in regions experiencing US-China competition. The malware's sophistication suggests Salt Typhoon will remain a persistent threat to governmental networks worldwide. ## Sources covering this story - https://www.theregister.com/security/2026/09/17/chinas-salt-typhoon-backdoors-latin-american-orgs-with-new-snooping-malware/5297286 — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._