CopperDragon's Sparrow framework powers three China-nexus espionage clusters across Latin America, Asia and Europe
Check Point Research tracks the entity behind the Sparrow malware framework as CopperDragon, which it assesses may act as a developer and supplier for several China-nexus actors, including FamousSparrow, Earth Estries, TropicTrooper and UAT-9244. A year-long investigation grouped the activity into three clusters: SilentDelivery (watering-hole attacks in Europe and Asia that deliver the previously undocumented SquadC backdoor), OceanGate (mainly Asian government and critical infrastructure, moving from Linux into Windows with SparrowShell, AnnobinDoor and SparrowDoor) and DarkWire (Latin American telecommunications providers and government bodies, using CopperDoor and CopperDNS). The targets include telecommunications providers, government, military, research institutions and critical infrastructure. The article reports no CVE, vendor advisory or patch; the intrusions rely on compromised websites, internet-facing servers, spear phishing and credential theft. Because this is a targeted espionage campaign with confirmed intrusions but no single exploitable product flaw, the criticity is high rather than critical.
Detalhes técnicos
- SilentDelivery: a heavily obfuscated JavaScript injected into compromised government, shipping, IT and research websites replaces the page with a fake Chrome SSL warning and lures the visitor into installing a "Certificate Fix" MSI. The script polls the C2 server before hijacking the page and reports the click to /report-url. The backdoor runs only if a browser process is present and persists through a Run key named WindowsUpdateAssist. A phishing archive, Strategi_AS_Referensi_April2026.rar, delivered the same SquadC chain to Indonesian targets.
- OceanGate: the intrusion began on an internet-facing Linux server with AnnobinDoor, a UPX-packed Go backdoor, followed by SparrowShell, which can load a Reptile-based kernel rootkit. The actor replaced SSH and SSHD binaries with credential-logging versions, then used RDP password guessing to reach a Windows administrator account. It deployed CopperAdu (hidden local admin account, LocalAccountTokenFilterPolicy set to 1), CopperList (file inventory), CopperLogger (Raw Input keylogger), CopperLsa (LSASS security package for credential capture) and a SparrowDoor variant that can use WinDivert for passive, port-hiding connections on port 443.
- DarkWire: CopperLoader, a reflective loader deployed through DLL sideloading, delivers CopperDoor (memory-resident, with call stack spoofing), CopperDNS (MX-query DNS tunnel), CopperProxy (SOCKS5), PyProxy (UDP relay) and CopperLsass, which loads slave.dll into LSASS, dumps it with comsvcs.dll and renames the encrypted dump to 1.png. SoftEther VPN was renamed to vmtoolsd.exe and csrss.exe; lateral movement used SMB and wmiexec.
- Melofee link: SparrowShell shares Reptile-based rootkit code and hide/show arguments with the Melofee backdoor, and Melofee samples share self-signed certificate patterns with it. Check Point assesses that CopperDragon is also involved in maintaining and supplying Melofee variants.
Detalhes da correção
No vendor fix applies: the story concerns espionage tooling, not a product vulnerability. The article does not name any CVE or patched version.
Linha do tempo
-
CopperDragon's Sparrow framework powers three China-nexus espionage clusters across Latin America, Asia and Europe
ler a análise desta fonte ocultar
Check Point Research tracks the entity behind the Sparrow malware framework as CopperDragon, which it assesses may act as a developer and supplier for several China-nexus actors, including FamousSparrow, Earth Estries, TropicTrooper and UAT-9244. A year-long investigation grouped the activity into three clusters: SilentDelivery (watering-hole attacks in Europe and Asia that deliver the previously undocumented SquadC backdoor), OceanGate (mainly Asian government and critical infrastructure, moving from Linux into Windows with SparrowShell, AnnobinDoor and SparrowDoor) and DarkWire (Latin American telecommunications providers and government bodies, using CopperDoor and CopperDNS). The targets include telecommunications providers, government, military, research institutions and critical infrastructure. The article reports no CVE, vendor advisory or patch; the intrusions rely on compromised websites, internet-facing servers, spear phishing and credential theft. Because this is a targeted espionage campaign with confirmed intrusions but no single exploitable product flaw, the criticity is high rather than critical.
Technical Details
- SilentDelivery: a heavily obfuscated JavaScript injected into compromised government, shipping, IT and research websites replaces the page with a fake Chrome SSL warning and lures the visitor into installing a "Certificate Fix" MSI. The script polls the C2 server before hijacking the page and reports the click to /report-url. The backdoor runs only if a browser process is present and persists through a Run key named WindowsUpdateAssist. A phishing archive, Strategi_AS_Referensi_April2026.rar, delivered the same SquadC chain to Indonesian targets.
- OceanGate: the intrusion began on an internet-facing Linux server with AnnobinDoor, a UPX-packed Go backdoor, followed by SparrowShell, which can load a Reptile-based kernel rootkit. The actor replaced SSH and SSHD binaries with credential-logging versions, then used RDP password guessing to reach a Windows administrator account. It deployed CopperAdu (hidden local admin account, LocalAccountTokenFilterPolicy set to 1), CopperList (file inventory), CopperLogger (Raw Input keylogger), CopperLsa (LSASS security package for credential capture) and a SparrowDoor variant that can use WinDivert for passive, port-hiding connections on port 443.
- DarkWire: CopperLoader, a reflective loader deployed through DLL sideloading, delivers CopperDoor (memory-resident, with call stack spoofing), CopperDNS (MX-query DNS tunnel), CopperProxy (SOCKS5), PyProxy (UDP relay) and CopperLsass, which loads slave.dll into LSASS, dumps it with comsvcs.dll and renames the encrypted dump to 1.png. SoftEther VPN was renamed to vmtoolsd.exe and csrss.exe; lateral movement used SMB and wmiexec.
- Melofee link: SparrowShell shares Reptile-based rootkit code and hide/show arguments with the Melofee backdoor, and Melofee samples share self-signed certificate patterns with it. Check Point assesses that CopperDragon is also involved in maintaining and supplying Melofee variants.
Fix Details
No vendor fix applies: the story concerns espionage tooling, not a product vulnerability. The article does not name any CVE or patched version.