China's Salt Typhoon Deploys New Malware in Latin America

On September 17, 2026, ESET reported that the China-backed espionage group Salt Typhoon is operating a new backdoor in Latin America. The group is tracked internally by ESET as FamousSparrow. The new backdoor is named SparroWocky. It has been detected in the communications networks of government agencies in multiple countries since at least August 2025. Reporting by Jessica Lyons of The Register highlighted the regional skew in targeting.

Salt Typhoon is known as a group that has maintained long-term persistence in telecom operators and government agencies since around 2019. The intrusions were uncovered in late 2023. Its hallmark is techniques to evade detection and maintain persistent access. The latest report indicates that its area of operations has shifted to Latin America. From mid-2025 to 2026, 90% of targets were concentrated in the region.

Overview of Attack Activity Concentrated in

Latin America

ESET malware researchers confirmed the deployment of SparroWocky in August 2025. Targets were government agencies in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela. They included high-profile organizations. Cases of a China-linked advanced persistent threat group intensively targeting the region are said to be rare. That distinctiveness is at the core of this report.

The shift in targeting occurred around July 2025. The new backdoor was confirmed about a month later. Rather than reusing existing infrastructure, the group introduced a new implant. The regional concentration and the emergence of the new tool are linked. ESET emphasizes this continuity.

The 90% concentration differs from the usual dispersed pattern of espionage activity. It suggests an intent to continuously monitor government responses in a specific region. Some view securing footholds in communications and administrative networks as the objective. It may be at the initial staging phase premised on long-term persistence. Additional samples and victim disclosures will be closely watched.

Structure of the New Backdoor SparroWocky

SparroWocky is an embeddable backdoor written in C++. It adopts an extensible architecture. It emerged after the group began focusing on Latin America. It incorporates measures to evade existing detection. The analyzed sample was compiled on November 17.

The name derives from Lewis Carroll’s poem “Jabberwocky.” The first stanza of the poem was found in multiple collected samples. Researchers named it based on that string. The verse is as follows.

’Twas brillig, and the slithy toves / Did gyre and gimble in the wabe: / All mimsy were the borogoves, / And the mome raths outgrabe.

Such strings help with sample identification and attribution. It is unclear whether the attackers left them intentionally. At minimum, they serve as an indicator to group samples of the same family. ESET used this characteristic to organize the family.

Abuse of Open-Source Technology and Evasion

SparroWocky incorporates publicly available components. It shortens development time by combining in-house development with existing assets. The aim is to protect communications with command-and-control infrastructure and evade defenses. The following components were confirmed. All are technologies with legitimate uses.

First, Mbed TLS. It is used as a C library for protected communication with command-and-control infrastructure. Encrypting communications makes detection and decryption difficult. Second, MinHook. It is a library for hooking Windows APIs. It hides the start address of newly created threads to evade monitoring by defensive products. Third, a COFF Loader or similar mechanism. It dynamically loads and executes COFF-format injected components in memory.

It is also said to incorporate a variant of a specific component. In the published summary, the relevant description breaks off mid-sentence. Detailed function names and version numbers cannot be confirmed at this time. However, it is clear that it has an extension mechanism combined with in-memory execution. It can be assessed as designed to keep the main body small and add functionality later.

This design is common in recent advanced persistent threats. The main body focuses on persistence and maintaining communications. Information theft and lateral movement functions are delivered as additional modules. Defenders need to monitor not only for detection of the main body but also for anomalous behavior in memory. Combining behavioral detection and communications analysis is essential.

Analysis of Espionage Intent Against the

Backdrop of US-China Confrontation

ESET researchers Alexandre Côté Cyr and Romain Dumont pointed to the political background. They analyze that the strengthening of Latin America policy by U.S. President Donald Trump is a factor. Their assessment is that China’s long-term investments and the U.S. pushback are colliding. The researchers wrote in the report as follows.

Donald Trump’s second presidential term has brought about an aggressive reaffirmation of US interests in Latin America, which threatens various long-term investments that China has cultivated throughout the continent in the last decade, in domains such as energy, mining, and telecommunications.

The target sectors include energy, mining, and telecommunications. China has built up interests on the continent over the past decade. U.S. pressure could change how local governments respond. This creates a need to grasp those reactions early. This is consistent as a motive for espionage activity.

The researchers further offered the following view on the purpose of the activity.

We suspect that FamousSparrow’s activities are intended to help China better monitor and anticipate the reaction of local governments to current US pressures.

The view is that the objective is to monitor and anticipate local governments’ reactions. Policymaking processes and trends in communications infrastructure are likely of interest. This aligns with the selection of government agencies as direct targets. Past intrusions into telecom operators can be understood in the same context. It is a case of geopolitical tensions being projected into cyberspace.

This article is based on The Register (All Rights Reserved). It relies on fair quotation under Article 32 of the Japanese Copyright Act.

Defensive Challenges Posed by Long-Term

Persistent Intrusions

Salt Typhoon’s techniques are characterized by long-term persistence and abuse of legitimate functions. The fact that activity dating from 2019 went undetected until late 2023 is significant. Telecom operators and government agencies have a wide monitoring scope, and anomaly detection tends to be delayed. This time as well, time elapsed between the August 2025 deployment and the report. Identifying the scope of damage during the dwell period will be a challenge.

Defenders are required to maintain asset inventory and communications visibility. Record destinations, certificates, and time-of-day biases of command-and-control communications. On endpoints, pick up signs of in-memory execution and thread concealment. Hooking technologies like MinHook are also used in legitimate products, making simple detection difficult. Operations that correlate multiple weak signals are important.

Visibility into development platforms and operational management also contributes to infrastructure defense. For example, for trends in development platforms, Cloudflare strengthens Vite/Astro development with VoidZero acquisition is a useful reference. From the perspective of tracking spending and assets, Rippling announces AI spend tracking tool ‘AI Spend Console’ is suggestive. From the perspective of leveraging public technologies, as shown by AI video generation MoneyPrinterTurbo surges on GitHub, the spread of open components continues. Attackers are riding that trend. Defenders must also thoroughly manage bills of materials and provenance.

For Latin American government agencies, reviewing supply chains is also urgent. Telecom equipment, outsourced development, and maintenance channels can become entry points. Multi-factor authentication and privilege separation alone cannot prevent long-term persistence. Log preservation and cross-checking with external sources are indispensable. Frameworks for information sharing beyond the region are being tested.

Editorial Opinion

On short-term impact. In the next 3 to 6 months, detection rules are expected to be updated, centered on Latin American government agencies and telecom operators. Based on ESET’s sample information, national CERTs and defensive products may strengthen their responses. Requests to review suppliers and maintenance contractors are also expected to increase. Japanese companies’ Latin American bases will also likely be required to take inventory of their communications routes.

On the long-term perspective. In 1 to 3 years, geopolitical tensions over energy, mining, and telecommunications are expected to lead to the normalization of cyber espionage. Embeddable and extensible implants will become mainstream. Defenders will be forced to invest in memory monitoring and communications analysis. International joint attribution disclosures linked to sanctions will also intensify.

Questions from the editorial team. Can espionage aimed at anticipating government reactions be countered by technical defenses alone? How should criteria be set to distinguish abuse of public components from legitimate use? Assuming long-term persistence of damage, how should mandatory log retention periods be designed? Debate connecting geopolitics and technical measures is called for.

References

• “China’s Salt Typhoon backdoors Latin American orgs with new snooping malware”, by Jessica Lyons — The Register, 2026-09-17T18:00:17.000Z (ARR)
• Source URL: https://www.theregister.com/security/2026/09/17/chinas-salt-typhoon-backdoors-latin-american-orgs-with-new-snooping-malware/5297286