Salt Typhoon shifts heavily into Latin America with new SparroWocky backdoor ESET says China-linked Salt Typhoon, tracked as FamousSparrow, has been deploying the new SparroWocky backdoor against government networks in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and #Venezuela since at least August 2025. The modular C++ implant uses TLS, DLL sideloading, in-memory plugins, and evasion features including MinHook and spoofed call stacks.