Do Son 
SilentDelivery infection chain | Image: Check Point Research
TL;DR
Security researchers uncovered three connected cyber espionage clusters operating across Latin America, Asia, and Europe that rely on the CopperDragon Sparrow framework. Rather than representing a single hacking team, the CopperDragon Sparrow framework malware ecosystem acts as a central supplier for multiple China-nexus threat groups. Over the past year, these clusters breached dozens of government, military, and telecommunications networks using custom Windows and Linux backdoors.
What Happened Across the Three Clusters
During a year-long investigation into intrusions hitting dozens of organizations, Check Point Research connected three seemingly separate campaigns: SilentDelivery, OceanGate, and DarkWire. While each campaign operated at a different pace and used distinct initial access methods, shared code and server certificates tied them to a single cross-platform toolkit. Independent reports from ESET and Positive Technologies also documented overlapping parts of this activity.
“We track the entity behind these campaigns as CopperDragon, which may serve as a digital quartermaster supporting a number of China-nexus threat actors that use the Sparrow cross-platform malware framework for Linux and Windows,” Check Point researchers wrote.
SilentDelivery Watering-Hole Attacks
Starting in early 2026, the SilentDelivery cluster compromised legitimate government, shipping, and IT websites across Europe and Asia. When a Windows user visited an infected site, jsjiami-obfuscated JavaScript fingerprinted their IP address and displayed a fake Google Chrome SSL certificate warning in the local language. Clicking the “Install Certificate” button downloaded a trojanized MSI installer from a compromised Amazon S3 bucket.
This installer deployed either a SparrowDoor variant or a new C/C++ backdoor named SquadC. To evade analysis, SquadC checks for virtual machine artifacts and only runs if a web browser process like chrome.exe or msedge.exe is currently open. Additionally, researchers found an Indonesian RAR archive delivering SquadC via a malicious LNK file that abused the legitimate ftp.exe utility.
OceanGate Linux and Windows Intrusions
Observed between 2025 and 2026, the OceanGate cluster targeted Asian government and critical infrastructure networks by first breaching internet-facing Linux servers. The attackers deployed AnnobinDoor, a UPX-packed Go backdoor using WebSocket traffic, alongside SparrowShell, a Linux equivalent of SparrowDoor. When launched with a specific hide flag, SparrowShell loads a modified version of the open-source Reptile kernel rootkit to conceal files, processes, and network connections. The operators also replaced legitimate SSH binaries with trojanized versions to capture administrator passwords.
Using stolen credentials, OceanGate pivoted to Windows machines via RDP and deployed four custom tools: CopperAdu (which creates a hidden admin$ account and opens TCP port 445), CopperList (a file scanner), CopperLogger (a keylogger and clipboard monitor), and CopperLsa (an LSASS security package). Notably, some Windows SparrowDoor samples embedded the legitimate WinDivert driver to act as a passive backdoor, intercepting incoming packets carrying the magic value 0x11223344 on port 443.
DarkWire Telecom Campaigns
Beginning in mid-2025, the DarkWire cluster targeted government justice and foreign affairs ministries alongside at least three major telecommunications providers in Latin America. DarkWire relied on a reflective shellcode loader named CopperLoader to decrypt payloads stripped of their MZ and PE headers. This loader delivered CopperDoor (tracked by ESET as SparroWocky), an in-memory backdoor using call-stack spoofing, and CopperDNS, which communicates via DNS MX queries. Operators also used CopperProxy, PyProxy, and CopperLsass, which dumps LSASS memory via comsvcs.dll and renames the encrypted file to 1.png before exfiltration.
Who Is Behind the Activity
Check Point Research attributes the development and maintenance of the toolset with high confidence to CopperDragon. Since FamousSparrow first appeared in 2021, security vendors have linked its tools to groups such as Earth Estries, TropicTrooper, UAT-9244, and Salt Typhoon. “Over time, it became apparent that this other activity was not necessarily carried out by the original FamousSparrow group. Instead, reporting pointed to several distinct actors using a shared toolset, potentially supplied by the same entity,” the researchers explained.
Furthermore, Check Point linked the CopperDragon Sparrow framework to the Melofee Linux backdoor, first spotted in 2023. Both SparrowShell and Melofee use identical Reptile rootkit loading routines and share expired self-signed TLS certificates listing “Internet Widgits Pty Ltd” and public DNS IP addresses like 8.8.8.8 or 1.1.1.1 in the Common Name field, a pattern also noted by Cisco Talos.
Impact and Global Scale
Across the three clusters, the CopperDragon Sparrow framework malware ecosystem enabled deep, long-term espionage across three continents. SilentDelivery hit targets in the Czech Republic, Germany, France, Taiwan, Nepal, Hong Kong, and Indonesia. Meanwhile, OceanGate gained full domain administrator control inside Asian government networks, and DarkWire placed command servers inside Latin American hosting providers to blend in with local telecom traffic.
How Organizations Can Stay Protected
To defend against the CopperDragon Sparrow framework, security teams must monitor both Windows and Linux environments for cross-platform pivoting. First, administrators should patch internet-facing Linux appliances and audit SSH binaries for unauthorized modifications. Second, defenders should watch for DLL side-loading inside existing directories like C:\ProgramData\USOShared or C:\Program Files\7-Zip\Lang involving legitimate binaries such as vlc.exe or fsptool.exe. Third, endpoint teams should alert on unauthorized WinDivert driver loads, rogue registry Run keys named WindowsUpdateAssist, and hidden local accounts named admin$. Finally, employees should be trained to ignore browser pop-ups asking to download manual MSI certificate fixes.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
