A China-aligned cyberespionage group targeted a Panamanian entity directly involved in the dispute over two major ports at opposite ends of the Panama Canal, cybersecurity firm ESET said on Sept. 17.
ESET said the group, known as FamousSparrow, sharply increased its focus on Latin America beginning in mid-2025. Ninety percent of the group’s targets recorded in ESET telemetry from mid-2025 into 2026 were in the region.
Researchers observed a newly identified backdoor, called SparroWocky, deployed against government entities in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela.
One of the Panamanian entities targeted was directly involved in a commercial dispute over the ports of Balboa and Cristóbal, ESET said.
“It seems highly likely that FamousSparrow’s operation was intended to gain early, privileged knowledge of local authorities’ intentions on this issue,” researchers Alexandre Côté Cyr and Romain Dumont wrote.
The dispute centers on a renewable 25-year government concession granting Panama Ports Company the right to develop and operate the Balboa and Cristóbal ports.
Related Stories
The concession contract was signed in December 1996 and approved under Panama’s Law No. 5 in January 1997. In 2021, the Panama Maritime Authority authorized a second 25-year term, extending the concession through Jan. 31, 2047.
ESET did not publicly identify the targeted Panamanian entity or say whether files concerning the port dispute were taken. The firm attributed the latest campaign and SparroWocky to FamousSparrow with “high confidence,” citing overlaps with malware and targets previously associated with the group.
The report did not identify a particular Chinese government or intelligence agency as directing the operation.
New Backdoor
ESET describes FamousSparrow as a China-aligned cyberespionage group believed to have operated since at least 2019. It was initially known for targeting hotels but has also targeted governments, international organizations, trade groups, engineering companies, and law firms.
The firm linked the latest campaign to FamousSparrow partly because some early attacks involving SparroWocky also used SparrowDoor, another backdoor that ESET says is used exclusively by the group. Researchers also recorded attempts to deploy SparroWocky at organizations previously targeted with SparrowDoor.
Once installed, SparroWocky can execute commands and files, collect information about an infected computer, take screenshots, route network traffic through the machine, and exfiltrate files. Information taken from infected systems can be encrypted before being sent to attacker-controlled servers.
ESET said the malware’s architecture and detection-avoidance techniques suggest its developers had substantial knowledge of Windows internals and methods to frustrate security analysis.
Alexandre Côté Cyr and Romain Dumont said FamousSparrow’s concentration on Latin America was unusual among the China-aligned hacking groups they track. ESET assessed that the activity may aim to help China anticipate how regional governments respond to increased U.S. pressure, while saying it remains unclear whether the regional concentration represents a formal geographic assignment or a temporary shift.
Dispute Over Balboa and Cristóbal
After the Supreme Court ruling took effect on Feb. 23, Panama’s government took control of the two terminals. An executive decree authorized the Panama Maritime Authority to temporarily occupy property needed to keep them operating, including computers, software, vehicles, and other equipment.
Panama Ports Company is an indirect subsidiary of Hong Kong-based CK Hutchison. CK Hutchison has challenged Panama’s actions through international proceedings.
In August, CK Hutchison began investment-treaty arbitration against Panama, seeking more than $1.5 billion in damages. The company alleges that Panama carried out a yearlong campaign against its investments that culminated in the Feb. 23 takeover of the terminals, including property, equipment, technology, employees, and company documents. Panama Ports Company is separately pursuing arbitration under the concession contract.
The Panama Maritime Authority has rejected the company’s allegations. The agency said in March that the Supreme Court ruling was “final, binding, and not subject to appeal” and that Panama was required to enforce it.
Puerto Rico Among Government Targets
Puerto Rico was among the jurisdictions where ESET observed SparroWocky deployed against government entities, giving the campaign a direct U.S. connection. ESET did not publicly identify the affected Puerto Rico entities or say whether information was successfully taken from them.
The Epoch Times sought additional information from ESET about the Panamanian target and whether port-related information was accessed or removed. It also sought comment from Panama’s Government Innovation Authority and national cyber-response team, the Panama Maritime Authority, Panama Ports Company and CK Hutchison, Puerto Rico’s Innovation and Technology Service, the FBI, the Cybersecurity and Infrastructure Security Agency, and Panama’s comptroller.
The agencies and companies contacted did not respond by publication time.
