China-Aligned FamousSparrow Deploys SparroWocky Backdoor Across Latin America

The China-aligned state-sponsored threat actor known as FamousSparrow has been observed deploying a previously unreported backdoor called SparroWocky in attacks targeting multiple countries in Latin America since at least August 2025. "SparroWocky is a modular, C++ backdoor," ESET security researchers Alexandre Côté Cyr and Romain Dumont said in a technical report shared with The Hacker News

Fact: The article reports that China-aligned state-sponsored group FamousSparrow is deploying a new modular C++ backdoor called SparroWocky in campaigns across multiple Latin American countries since at least August 2025, as documented by ESET researchers. Fact: The described activity focuses on cyber-espionage malware and backdoor deployment against regional targets, not explicitly on AI models or agents. RealGround analysis: While the report does not mention AI directly, such state-backed backdoors can compromise infrastructure that hosts or supplies AI systems, creating indirect risk to AI supply chains and model integrity. RealGround analysis: Organizations running or depending on AI services in affected regions should treat this as a supply-chain and infrastructure threat, harden monitoring around AI hosting environments, and maintain detailed SBOMs and dependency inventories to detect compromised components.