ChinaAssessedChina-alignedEspionageActive 2019 – 2026FamousSparrow
Summary
China-aligned espionage group named by ESET, active since at least August 2019. It first targeted hotels worldwide plus governments, international organisations, engineering firms and law firms (2021 victims included Saudi Arabia, Israel, the UK, Canada and Taiwan), breaking in through vulnerable internet-facing applications including ProxyLogon in March 2021. It is the only known user of the SparrowDoor backdoor. In July 2024 it breached a US financial-sector trade group and a Mexican research institute, adding ShadowPad. Since mid-2025 about 90% of its targets have been in Latin America: from August 2025 it replaced SparrowDoor with a new modular C++ backdoor, SparroWocky, deployed against government bodies in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico and Venezuela, and in January 2026 it targeted a Venezuelan government entity responsible for maritime affairs, likely to monitor oil-shipment resilience after the US intervention. Microsoft folds FamousSparrow into Salt Typhoon; ESET keeps it distinct with only loose links (shared tooling suggests a common 'digital quartermaster').
Attribution
No service publicly named
Assessed by security researchers or MITRE ATT&CK; no government attribution on record.
- ESET Research (Research, 2025-03-26)
China-aligned APT group
Campaigns 4
| Campaign | Period | Targets | Sectors | Source |
|---|---|---|---|---|
| Venezuelan government maritime authority — oil-shipment monitoring | 2026-01 | Venezuela | Government, Maritime | ESET APT Activity Report Q4 2025–Q1 2026 |
| SparroWocky backdoor against Latin American governments | 2025-07 – 2026 | Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, Venezuela | Government | ESET Research (2026-09-17) |
| US financial-sector trade group and Mexican research institute (Jul 2024; new SparrowDoor versions, ShadowPad); Honduran government institution (2022–2024) | 2022 – 2024-07 | USA, Mexico, Honduras | Finance, Research, Government | ESET Research (2025-03-26) |
| Hotels, governments and law firms worldwide — ProxyLogon and other web-app exploitation | 2019-08 – 2021-03 | Saudi Arabia, Israel, UK, Canada, France, Taiwan, Thailand, Brazil | Hospitality, Government, Legal | ESET Research (2021-09-23) |
Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.
MITRE ATT&CK techniques 4
| Initial Access1 | T1190Exploit Public-Facing Application |
|---|---|
| Persistence1 | T1505.003Web Shell |
| Collection1 | T1113Screen Capture |
| Command and Control1 | T1090Proxy |
Malware and tools 3
| Name | Description | Platform |
|---|---|---|
| SparrowDoor | Backdoor (exclusive to FamousSparrow) | Windows |
| SparroWocky | Modular C++ backdoor | Windows |
| ShadowPad | Modular backdoor (shared China-nexus) | Windows |
Exploited vulnerabilities 1
| CVE | CVSS | Detail |
|---|---|---|
| CVE-2021-26855 | 9.1 | Exchange ProxyLogon (KEV 2021-11-03) |
Highest CVSS first.
Infrastructure patterns
- Domains via Hosting Concepts; servers from Shanghai Ruisu and DAOU TECHNOLOGY (ESET, 2021)
- Own servers host SparrowDoor and PowerHub; C&C on Hong Kong hosting (ESET, 2025)
Reporting and advisories 4
- ESET Research
Hotels, governments and law firms worldwide — ProxyLogon and other web-app exploitation - ESET Research
US financial-sector trade group and Mexican research institute (Jul 2024; new SparrowDoor versions, ShadowPad); Honduran government institution (2022–2024) - ESET Research
SparroWocky backdoor against Latin American governments - ESET APT Activity Report Q4 2025–Q1 2026
Venezuelan government maritime authority — oil-shipment monitoring