# China's Salt Typhoon targets Latin America with new backdoor

> Chinese hackers shift focus to eight Latin American countries, deploying malware to monitor governments amid US pressure in the region.
- Title: China's Salt Typhoon targets Latin America with new backdoor
- Summary: Chinese hackers shift focus to eight Latin American countries, deploying malware to monitor governments amid US pressure in the region. Salt Typhoon, a…
- Keywords: salt typhoon, sparrowocky, latin america, china, cybersecurity, malware, eset, argentina, peru, venezuela, technology, China's
- Source: TechRadar — https://techradar.com/pro/security/chinas-salt-typhoon-spotted-probing-latin-american-government-with-newly-developed-sparrowocky-backdoor
- Published: 2026-09-18T17:35:00+00:00
- Read time: 1 min
- Topics: salt typhoon, sparrowocky, latin america, china, cybersecurity, malware, eset, argentina, peru, venezuela, technology
## Chinese hackers shift to Latin America
Cybersecurity researchers ESET have tracked Salt Typhoon, a Chinese state-sponsored threat actor, hacking telecoms and government agencies worldwide since at least two thousand nineteen.
## Eight countries targeted since mid-two thousand twenty-five
From mid-two thousand twenty-five into two thousand twenty-six, Salt Typhoon targeted Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela with new malware.
## New SparroWocky backdoor deployed
The group deployed SparroWocky, a backdoor featuring around thirty commands for system profiling, file exfiltration, screenshot grabbing, and surveillance. Around ninety percent of Salt Typhoon's recent activity focused on this region.
## Response to Trump's Latin America push
ESET says the pivot is a rare occurrence and likely responds to Donald Trump's aggressive reaffirmation of US interests in Latin America, which threatens China's long-term investments in energy, mining, and telecommunications.

> Donald Trump's second presidential term has brought about an aggressive reaffirmation of US interests in Latin America, which threatens various long-term investments that China has cultivated throughout the continent in the last decade, in domains such as energy, mining, and telecommunications.
## Monitoring local government reactions
ESET suspects Salt Typhoon's activities help China monitor and anticipate how local governments react to current US pressures in the region.

> We suspect that FamousSparrow's activities are intended to help China better monitor and anticipate the reaction of local governments to current US pressures.
## Malware delivered via trident loader scheme
The backdoor is delivered through a trident loader scheme using a legitimate executable, a malicious DLL, and an encrypted malware file. Side-loading the DLL allows deployment without detection.
## Key takeaway

Salt Typhoon, a Chinese state-sponsored hacking group, has shifted operations to Latin America since mid-two thousand twenty-five, targeting eight countries with new malware as China responds to US influence in the region.