China-linked CopperDragon suspected supplier of Sparrow framework malware across three major hack clusters
Check Point Research (CPR) revealed that three China-nexus intrusion clusters—SilentDelivery, OceanGate, and DarkWire—operating across Latin America, Asia, and Europe share the Sparrow malware framework and infrastructure. These campaigns primarily target government, critical infrastructure, telecom, and research sectors, demonstrating a broad regional scope and diverse target sectors. CPR attributes the supply and possible development of the Sparrow framework and variants like SparrowDoor and Melofee backdoor to a suspected supplier termed 'CopperDragon,' acting potentially as a digital quartermaster for multiple Chinese-affiliated threat actors. While DarkWire lacks direct code similarities with CopperDragon tools, its infrastructure ties to FamousSparrow-linked domains suggest intertwined operations. The findings enable finer tracking of operations clustered previously under FamousSparrow and demonstrate how shared malware and infrastructure can obscure distinctions between different operators and campaigns.
Linha do tempo
-
China-linked CopperDragon suspected supplier of Sparrow framework malware across three major hack clusters
ler a análise desta fonte ocultar
Check Point Research (CPR) revealed that three China-nexus intrusion clusters—SilentDelivery, OceanGate, and DarkWire—operating across Latin America, Asia, and Europe share the Sparrow malware framework and infrastructure. These campaigns primarily target government, critical infrastructure, telecom, and research sectors, demonstrating a broad regional scope and diverse target sectors. CPR attributes the supply and possible development of the Sparrow framework and variants like SparrowDoor and Melofee backdoor to a suspected supplier termed 'CopperDragon,' acting potentially as a digital quartermaster for multiple Chinese-affiliated threat actors. While DarkWire lacks direct code similarities with CopperDragon tools, its infrastructure ties to FamousSparrow-linked domains suggest intertwined operations. The findings enable finer tracking of operations clustered previously under FamousSparrow and demonstrate how shared malware and infrastructure can obscure distinctions between different operators and campaigns.