SparroWocky research follows a backdoor lineage across campaigns

Findings and evidence

ESET documents SparroWocky, a modular C++ backdoor that its researchers associate with FamousSparrow. The report traces a shift from SparrowDoor and increased observed targeting of government organizations in Latin America.

Why it matters

Comparing versions helps analysts separate a family’s durable characteristics from features unique to one specimen. Keep sample provenance and observation dates attached to any lineage or campaign claim.

Scope and limits

Family similarity supports a hypothesis, not automatic actor attribution. ESET’s victimology describes its visibility and should not be treated as a complete inventory of affected organizations.

Primary source

ESET Research: original publication. Source published 2026-09-17. Brief prepared by websec.gr on 26 September 2026. This is an editorial research summary, not a claim of independent replication.