Chinese hackers shift to Latin America

Cybersecurity researchers ESET have tracked Salt Typhoon, a Chinese state-sponsored threat actor, hacking telecoms and government agencies worldwide since at least two thousand nineteen.

Eight countries targeted since mid-two thousand twenty-five

From mid-two thousand twenty-five into two thousand twenty-six, Salt Typhoon targeted Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela with new malware.

New SparroWocky backdoor deployed

The group deployed SparroWocky, a backdoor featuring around thirty commands for system profiling, file exfiltration, screenshot grabbing, and surveillance. Around ninety percent of Salt Typhoon's recent activity focused on this region.

Response to Trump's Latin America push

ESET says the pivot is a rare occurrence and likely responds to Donald Trump's aggressive reaffirmation of US interests in Latin America, which threatens China's long-term investments in energy, mining, and telecommunications.

“Donald Trump's second presidential term has brought about an aggressive reaffirmation of US interests in Latin America, which threatens various long-term investments that China has cultivated throughout the continent in the last decade, in domains such as energy, mining, and telecommunications.”

Monitoring local government reactions

ESET suspects Salt Typhoon's activities help China monitor and anticipate how local governments react to current US pressures in the region.

“We suspect that FamousSparrow's activities are intended to help China better monitor and anticipate the reaction of local governments to current US pressures.”

Malware delivered via trident loader scheme

The backdoor is delivered through a trident loader scheme using a legitimate executable, a malicious DLL, and an encrypted malware file. Side-loading the DLL allows deployment without detection.