China's Salt Typhoon deploys SparroWocky malware in Latin America
New modular backdoor targets governments amid US-China geopolitical tensions
1Geopolitical shift in cyber operations
Chinese APT group Salt Typhoon redirected 90% of its operations to Latin America starting mid-2025, marking a strategic pivot from previous global targets. Researchers attribute this shift to China's response to renewed US engagement in the region under Trump's second term. The group specifically targeted government agencies in eight countries, including Argentina and Peru, focusing on sectors where China has significant investments like energy and telecommunications.
2SparroWocky's technical architecture
The newly discovered backdoor combines multiple evasion techniques with open-source components including Mbed TLS for secure C2 communication and MinHook for API hooking. It implements COFF Loader for dynamic plugin execution and SilentMoonwalk stack spoofing to bypass security monitoring. The malware uses TLS encryption over ports 443/8080 and features a custom API-hashing algorithm to dynamically resolve Windows functions, demonstrating advanced tradecraft in persistent access operations.
3Operational timeline reveals persistence
Salt Typhoon's activities date back to 2019, though their campaigns went undetected until 2023. The group maintained long-term access to telecom and government networks before developing SparroWocky in 2025. ESET's analysis of a November 2025 sample shows continuous evolution, with the malware incorporating new techniques like WTSEnumerateSessionsW for remote session enumeration and periodic screenshot capture capabilities.
4Loader mechanism and execution flow
The infection chain uses a trident loader scheme comprising a legitimate executable, malicious DLL, and encrypted payload. DLL side-loading initiates execution, after which WinHandler class manages nearly 30 commands including file exfiltration, process spawning, and persistence removal. The malware collects comprehensive system details before establishing C2 communication, with all data exfiltrated via TLS-encrypted channels to hardcoded IP addresses.
5Cultural references in malware
Researchers found the first stanza of Lewis Carroll's Jabberwocky poem embedded in multiple samples, suggesting the group's penchant for literary references. This follows the cybersecurity tradition of malware authors leaving distinctive signatures, though the poem's inclusion appears purely decorative rather than functional. The name SparroWocky itself blends the group's tracking name (FamousSparrow) with Carroll's nonsense verse.
6Defensive implications
ESET published full IoCs on GitHub, enabling network defenders to hunt for SparroWocky artifacts. The malware's use of legitimate open-source tools complicates detection, requiring behavioral analysis rather than signature-based approaches. Security teams should monitor for DLL side-loading anomalies, unexpected COFF object loading, and MinHook API hooking patterns, especially in organizations with Latin American operations.
7Geoeconomic context
The targeting aligns with China's $250B+ investments in Latin American infrastructure since 2015. Researchers suggest the cyber operations aim to monitor local government responses to US pressure on Chinese projects. Specific sectors targeted—telecom, energy, mining—mirror areas where Chinese firms face competition from US-backed alternatives, indicating intelligence gathering supports economic decision-making.
8Evolution of China-aligned APTs
Salt Typhoon's Latin American focus represents a departure from typical Chinese cyber operations, which historically prioritized Southeast Asia and Africa. The group's sustained access since 2019 and rapid tooling development in 2025 demonstrate advanced persistent threat capabilities. This campaign signals China's willingness to leverage cyber means for geopolitical ends in secondary theaters of competition.