China's Salt Typhoon backdoors Latin American orgs with new snooping malware

China’s Salt Typhoon gang has developed a new backdoor and dropped it in networks belonging to high-profile organizations in several countries across Central and South America since at least August 2025, according to researchers.

The PRC-backed espionage crew shifted its focus to Latin America a month prior, and from mid-2025 into 2026, the vast majority - 90 percent - of Salt Typhoon’s targets were located in that region, ESET, which tracks the group as FamousSparrow, said in a Thursday report.

Salt Typhoon is the cyber-spy gang that hacked telecommunications and government agencies to gain stealthy, long-term access to victim organizations going back as far as 2019.

These hacks, however, weren’t discovered until late 2023.

In August 2025, ESET’s malware hunters found the group’s new backdoor, called SparroWocky, deployed against government agencies in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela.

While targeting entities in these countries “represents a rare occurrence among the China-aligned APT groups,” ESET believes the focus likely reflects China’s reaction to recent US President Donald Trump’s initiatives in the region, malware researchers Alexandre Côté Cyr and Romain Dumont said.

“Donald Trump’s second presidential term has brought about an aggressive reaffirmation of US interests in Latin America, which threatens various long-term investments that China has cultivated throughout the continent in the last decade, in domains such as energy, mining, and telecommunications,” they wrote.

“We suspect that FamousSparrow’s activities are intended to help China better monitor and anticipate the reaction of local governments to current US pressures.” SparroWocky is a modular C++ backdoor that appeared soon after the Beijing snoops started focusing on Latin America.

The new backdoor integrates open source tools and uses techniques designed to evade antivirus and other security software.

The name comes from Lewis Carroll’s Jabberwocky poem - the researchers found the first stanza in several collected samples. (’Twas brillig, and the slithy toves/Did gyre and gimble in the wabe:/All mimsy were the borogoves,/And the mome raths outgrabe.) ESET based its analysis on a malware sample compiled on November 17, and said it contained the following open source projects: Mbed TLS, a C library it uses to establish a secure communication channel with its command-and-control (C2) server.

MinHook, a Windows API hooking library that hides the start address of newly created threads from security products.

COFF Loader (or a similar project) to enable dynamic loading and execution of in-memory plugins in the form of COFF objects.