ESET: Salt Typhoon Targets Latin America With New SparroWocky Backdoor

ESET says roughly 90 percent of Salt Typhoon's recent activity was devoted to Latin America. The group deployed SparroWocky, a backdoor with about 30 commands, including system profiling, file exfiltration and screenshot grabbing. ESET describes the discovery of China-built malware in these countries as a rare occurrence. Latin America is not an open ally of China, the researchers note, but China remains influential in the region economically and diplomatically.

The researchers link the shift to the second presidential term of Donald Trump and what they describe as an aggressive reaffirmation of US interests in Latin America. ESET says that push threatens various long-term Chinese investments cultivated across the continent over the past decade in domains such as energy, mining and telecommunications. "Donald Trump's second presidential term has brought about an aggressive reaffirmation of US interests in Latin America, which threatens various long-term investments that China has cultivated throughout the continent in the last decade, in domains such as energy, mining, and telecommunications," ESET says. "We suspect that FamousSparrow's activities are intended to help China better monitor and anticipate the reaction of local governments to current US pressures." ESET uses the name FamousSparrow for Salt Typhoon.

According to ESET, SparroWocky is delivered through a trident loader scheme made up of a legitimate executable, a malicious DLL and a file containing the encrypted malware. By side-loading the DLL, the attackers can deploy the malware without being spotted. ESET has been tracking Salt Typhoon for years, and the group was previously seen hacking telecommunications giants and government agencies across the Western world.