sparrowocky

SparroWocky is a Windows backdoor documented by ESET in an espionage campaign targeting government entities in Latin America. The tagged coverage focuses on how the malware operates inside Windows networks: DLL side-loading, in-memory payload execution, registry or service persistence, remote-session access, file theft, and screenshot collection. A recurring theme is attribution, since ESET links the activity with high confidence to the China-aligned group FamousSparrow rather than Salt Typhoon. For defenders, the practical takeaway is detection and response work around persistence, side-loading, and long-term resident access on Windows systems.