Disguised Origins
ESET’s 17 September 2026 analysis attributes SparroWocky to China-aligned FamousSparrow at high confidence, citing Latin American government deployments by August 2025; geopolitical motives remain assessments, not proof of government instructions.
A distinct modular C++ successor to SparrowDoor integrates public components. An authentic executable loads an adversarial DLL to decrypt a separate payload for memory execution. Features include commands, file theft, screenshots and in-memory modules.
Its thread hook presents AnimateWindow as its apparent origin; a patched trampoline reaches real code. The genuine function is benign. Capabilities do not prove use. The researchers keep it separate from Salt Typhoon; technical equivalence is unproved.
MITRE’s library reference explains why trusted-name or file-type allowlists cannot establish safety. Examine which library loaded, its origin, persistence and subsequent activity. This is a hunting principle, not a universal detector.
Trace the relationship
- Use the linked hashes and infrastructure; date matches against available telemetry.
- Correlate unusual library loads, persistence and outbound connections; preserve underlying events rather than trusting process names.
- Check module, process and network logging and retention; absent results may reflect missing evidence.
- Use authorised tests with qualified practitioners; never execute malware on production devices.
- Investigate despite uncertain attribution; resemblance alone does not identify this actor.
Our recommendations do not imply European expansion.
The separate GrayRabbit/Sogou Input Method case provides related desktop-software context, not an operational connection.
