CopperDragon Sparrow Framework Sustains Widespread Espionage Clusters Targeting Governments and Telecoms Across Three Continents
Security researchers revealed a malware ecosystem dubbed CopperDragon Sparrow framework, serving multiple China-nexus espionage groups through interconnected clusters named SilentDelivery, OceanGate, and DarkWire. These clusters have operated since at least 2025, infiltrating government, military, telecommunications, and critical infrastructure networks in Latin America, Asia, and Europe. The framework comprises custom Windows and Linux backdoors and sophisticated tools enabling long-term espionage and cross-platform pivoting. SilentDelivery uses watering-hole attacks with trojanized MSI installers; OceanGate leverages Linux and Windows malware including a rootkit to maintain stealth; DarkWire focuses on telecom targets with reflective loaders and DNS tunneling. Check Point Research attributes the toolkit to a central controlled supply effort supporting multiple threat actors linked to reputed China-nexus groups. Defenders are advised to monitor for modified SSH binaries, unauthorized DLL side-loading, rogue WinDivert driver use, hidden accounts, and suspicious browser pop-ups.
Linha do tempo
-
CopperDragon Sparrow Framework Sustains Widespread Espionage Clusters Targeting Governments and Telecoms Across Three Continents
ler a análise desta fonte ocultar
Security researchers revealed a malware ecosystem dubbed CopperDragon Sparrow framework, serving multiple China-nexus espionage groups through interconnected clusters named SilentDelivery, OceanGate, and DarkWire. These clusters have operated since at least 2025, infiltrating government, military, telecommunications, and critical infrastructure networks in Latin America, Asia, and Europe. The framework comprises custom Windows and Linux backdoors and sophisticated tools enabling long-term espionage and cross-platform pivoting. SilentDelivery uses watering-hole attacks with trojanized MSI installers; OceanGate leverages Linux and Windows malware including a rootkit to maintain stealth; DarkWire focuses on telecom targets with reflective loaders and DNS tunneling. Check Point Research attributes the toolkit to a central controlled supply effort supporting multiple threat actors linked to reputed China-nexus groups. Defenders are advised to monitor for modified SSH binaries, unauthorized DLL side-loading, rogue WinDivert driver use, hidden accounts, and suspicious browser pop-ups.