EN PT-BR
← Voltar ao feed
high government telecommunications military research critical_infrastructure shipping it

CopperDragon: China-nexus Sparrow espionage ecosystem targets government and telecom in 21 countries

1 fonte(s) · 1 atualização(ões) · publicado 10/11/2026 10:00 · coletado há 1 hora

A year-long Check Point Research investigation (blog.checkpoint.com) links three China-nexus espionage clusters, SilentDelivery, OceanGate and DarkWire, which target government, telecommunications, military, research and critical infrastructure organizations in Latin America, Asia and Europe. The vendor tracks the entity behind the Sparrow framework as CopperDragon and suggests it acts as a common supplier of malware and infrastructure to several operators, so shared tools alone do not prove a single actor. Activity was observed in 21 countries, including previously undocumented activity in Asia with a strong focus on India, and new Windows and Linux malware such as SquadC, AnnobinDoor and SparrowShell. The write-up names no CVE and no fix, so there is no patch to apply; the risk comes from targeted intrusions built on common techniques rather than from a single flaw that can be exploited at scale. Criticity is high because this is an active, targeted espionage operation against high-value sectors, but no vulnerability is rated or confirmed as exploited in the wild.

Detalhes técnicos

  • SilentDelivery compromises legitimate websites in sectors such as government, shipping, IT and research and injects heavily obfuscated JavaScript. Selected visitors see a fake Chrome certificate error with an install button that delivers a supposed certificate repair utility, which installs SquadC or, in some cases, SparrowDoor. Activity in this cluster was reported in Germany, France and Czech Republic (blog.checkpoint.com).
  • OceanGate exploits internet-facing Linux systems and deploys AnnobinDoor and SparrowShell. Trojanized SSH components capture credentials during administrative work, which lets the operators pivot between Linux hosts and then into Windows networks, where they use CopperLogger (keystrokes and clipboard), CopperLsa (authentication data) and CopperList (system and file inventory) (blog.checkpoint.com).
  • DarkWire is concentrated in Latin America, with more recent intrusions outside the region, and targets telecommunications providers and government organizations with CopperDoor, CopperDNS and tools for credential harvesting, internal reconnaissance and network movement (blog.checkpoint.com).
  • Telecom compromise can expose call detail records, subscriber locations and SMS content, and in some environments lawful intercept systems (blog.checkpoint.com).
  • Evasion: SparrowShell can integrate a modified Reptile rootkit that hides processes, files and network activity on Linux, and some SparrowDoor variants use WinDivert to intercept traffic so that malicious communications blend with legitimate services (blog.checkpoint.com).

Remediação

The vendor recommends the following measures (blog.checkpoint.com):

  • Keep an accurate inventory of internet-facing systems, patch known vulnerabilities quickly and monitor exposed servers for unusual processes, authentication events and connections.
  • Inspect websites and downloads, especially unexpected certificate fixes or software updates offered through a web page.
  • Monitor for malicious DLL loading, credential dumping, keylogging, persistence and misuse of legitimate administrative tools.
  • Restrict RDP, SMB and SSH to the systems and accounts that need them, and investigate abnormal administrative access.
  • Monitor DNS, command-and-control traffic and unusual outbound connections for backdoors and tunnelling.

Linha do tempo

  1. blog.checkpoint.com ↗ · pub. 10/11/2026 10:00 · coletado 10/11 12:00 primeiro registro

    CopperDragon: China-nexus Sparrow espionage ecosystem targets government and telecom in 21 countries

    ler a análise desta fonte

    A year-long Check Point Research investigation (blog.checkpoint.com) links three China-nexus espionage clusters, SilentDelivery, OceanGate and DarkWire, which target government, telecommunications, military, research and critical infrastructure organizations in Latin America, Asia and Europe. The vendor tracks the entity behind the Sparrow framework as CopperDragon and suggests it acts as a common supplier of malware and infrastructure to several operators, so shared tools alone do not prove a single actor. Activity was observed in 21 countries, including previously undocumented activity in Asia with a strong focus on India, and new Windows and Linux malware such as SquadC, AnnobinDoor and SparrowShell. The write-up names no CVE and no fix, so there is no patch to apply; the risk comes from targeted intrusions built on common techniques rather than from a single flaw that can be exploited at scale. Criticity is high because this is an active, targeted espionage operation against high-value sectors, but no vulnerability is rated or confirmed as exploited in the wild.

    Technical Details

    • SilentDelivery compromises legitimate websites in sectors such as government, shipping, IT and research and injects heavily obfuscated JavaScript. Selected visitors see a fake Chrome certificate error with an install button that delivers a supposed certificate repair utility, which installs SquadC or, in some cases, SparrowDoor. Activity in this cluster was reported in Germany, France and Czech Republic (blog.checkpoint.com).
    • OceanGate exploits internet-facing Linux systems and deploys AnnobinDoor and SparrowShell. Trojanized SSH components capture credentials during administrative work, which lets the operators pivot between Linux hosts and then into Windows networks, where they use CopperLogger (keystrokes and clipboard), CopperLsa (authentication data) and CopperList (system and file inventory) (blog.checkpoint.com).
    • DarkWire is concentrated in Latin America, with more recent intrusions outside the region, and targets telecommunications providers and government organizations with CopperDoor, CopperDNS and tools for credential harvesting, internal reconnaissance and network movement (blog.checkpoint.com).
    • Telecom compromise can expose call detail records, subscriber locations and SMS content, and in some environments lawful intercept systems (blog.checkpoint.com).
    • Evasion: SparrowShell can integrate a modified Reptile rootkit that hides processes, files and network activity on Linux, and some SparrowDoor variants use WinDivert to intercept traffic so that malicious communications blend with legitimate services (blog.checkpoint.com).

    Remediation

    The vendor recommends the following measures (blog.checkpoint.com):

    • Keep an accurate inventory of internet-facing systems, patch known vulnerabilities quickly and monitor exposed servers for unusual processes, authentication events and connections.
    • Inspect websites and downloads, especially unexpected certificate fixes or software updates offered through a web page.
    • Monitor for malicious DLL loading, credential dumping, keylogging, persistence and misuse of legitimate administrative tools.
    • Restrict RDP, SMB and SSH to the systems and accounts that need them, and investigate abnormal administrative access.
    • Monitor DNS, command-and-control traffic and unusual outbound connections for backdoors and tunnelling.