CopperDragon's Sparrow ecosystem links three China-nexus espionage clusters (SilentDelivery, OceanGate, DarkWire) hitting 21 countries

Linha do tempo

1. thehackernews.com ↗ · pub. 10/11/2026 14:43 · coletado 10/11 17:00

   Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem

   ler a análise desta fonte ocultar

   Three distinct threat activity clusters with shared infrastructure and malware code similarities have been observed targeting telecommunications providers, government organizations, military entities, research institutions, and critical infrastructure across Latin America, Asia, and Europe over the past year.

   Check Point Research is tracking the clusters under the names SilentDelivery, OceanGate, and DarkWire. Although initially assumed to be independent sets of attacks, each with its own backdoors and post-exploitation tooling, they have all been linked through a malware ecosystem called Sparrow.

2. research.checkpoint.com ↗ · pub. 10/11/2026 11:01 · coletado 10/11 12:00

   CopperDragon's Sparrow framework powers three China-nexus espionage clusters across Latin America, Asia and Europe

   ler a análise desta fonte ocultar

   Check Point Research tracks the entity behind the Sparrow malware framework as CopperDragon, which it assesses may act as a developer and supplier for several China-nexus actors, including FamousSparrow, Earth Estries, TropicTrooper and UAT-9244. A year-long investigation grouped the activity into three clusters: SilentDelivery (watering-hole attacks in Europe and Asia that deliver the previously undocumented SquadC backdoor), OceanGate (mainly Asian government and critical infrastructure, moving from Linux into Windows with SparrowShell, AnnobinDoor and SparrowDoor) and DarkWire (Latin American telecommunications providers and government bodies, using CopperDoor and CopperDNS). The targets include telecommunications providers, government, military, research institutions and critical infrastructure. The article reports no CVE, vendor advisory or patch; the intrusions rely on compromised websites, internet-facing servers, spear phishing and credential theft. Because this is a targeted espionage campaign with confirmed intrusions but no single exploitable product flaw, the criticity is high rather than critical.

   Technical Details

   • SilentDelivery: a heavily obfuscated JavaScript injected into compromised government, shipping, IT and research websites replaces the page with a fake Chrome SSL warning and lures the visitor into installing a "Certificate Fix" MSI. The script polls the C2 server before hijacking the page and reports the click to /report-url. The backdoor runs only if a browser process is present and persists through a Run key named WindowsUpdateAssist. A phishing archive, Strategi_AS_Referensi_April2026.rar, delivered the same SquadC chain to Indonesian targets.
   • OceanGate: the intrusion began on an internet-facing Linux server with AnnobinDoor, a UPX-packed Go backdoor, followed by SparrowShell, which can load a Reptile-based kernel rootkit. The actor replaced SSH and SSHD binaries with credential-logging versions, then used RDP password guessing to reach a Windows administrator account. It deployed CopperAdu (hidden local admin account, LocalAccountTokenFilterPolicy set to 1), CopperList (file inventory), CopperLogger (Raw Input keylogger), CopperLsa (LSASS security package for credential capture) and a SparrowDoor variant that can use WinDivert for passive, port-hiding connections on port 443.
   • DarkWire: CopperLoader, a reflective loader deployed through DLL sideloading, delivers CopperDoor (memory-resident, with call stack spoofing), CopperDNS (MX-query DNS tunnel), CopperProxy (SOCKS5), PyProxy (UDP relay) and CopperLsass, which loads slave.dll into LSASS, dumps it with comsvcs.dll and renames the encrypted dump to 1.png. SoftEther VPN was renamed to vmtoolsd.exe and csrss.exe; lateral movement used SMB and wmiexec.
   • Melofee link: SparrowShell shares Reptile-based rootkit code and hide/show arguments with the Melofee backdoor, and Melofee samples share self-signed certificate patterns with it. Check Point assesses that CopperDragon is also involved in maintaining and supplying Melofee variants.

   Fix Details

   No vendor fix applies: the story concerns espionage tooling, not a product vulnerability. The article does not name any CVE or patched version.

3. blog.checkpoint.com ↗ · pub. 10/11/2026 10:00 · coletado 10/11 12:00 primeiro registro

   CopperDragon: China-nexus Sparrow espionage ecosystem targets government and telecom in 21 countries

   ler a análise desta fonte ocultar

   A year-long Check Point Research investigation (blog.checkpoint.com) links three China-nexus espionage clusters, SilentDelivery, OceanGate and DarkWire, which target government, telecommunications, military, research and critical infrastructure organizations in Latin America, Asia and Europe. The vendor tracks the entity behind the Sparrow framework as CopperDragon and suggests it acts as a common supplier of malware and infrastructure to several operators, so shared tools alone do not prove a single actor. Activity was observed in 21 countries, including previously undocumented activity in Asia with a strong focus on India, and new Windows and Linux malware such as SquadC, AnnobinDoor and SparrowShell. The write-up names no CVE and no fix, so there is no patch to apply; the risk comes from targeted intrusions built on common techniques rather than from a single flaw that can be exploited at scale. Criticity is high because this is an active, targeted espionage operation against high-value sectors, but no vulnerability is rated or confirmed as exploited in the wild.

   Technical Details

   • SilentDelivery compromises legitimate websites in sectors such as government, shipping, IT and research and injects heavily obfuscated JavaScript. Selected visitors see a fake Chrome certificate error with an install button that delivers a supposed certificate repair utility, which installs SquadC or, in some cases, SparrowDoor. Activity in this cluster was reported in Germany, France and Czech Republic (blog.checkpoint.com).
   • OceanGate exploits internet-facing Linux systems and deploys AnnobinDoor and SparrowShell. Trojanized SSH components capture credentials during administrative work, which lets the operators pivot between Linux hosts and then into Windows networks, where they use CopperLogger (keystrokes and clipboard), CopperLsa (authentication data) and CopperList (system and file inventory) (blog.checkpoint.com).
   • DarkWire is concentrated in Latin America, with more recent intrusions outside the region, and targets telecommunications providers and government organizations with CopperDoor, CopperDNS and tools for credential harvesting, internal reconnaissance and network movement (blog.checkpoint.com).
   • Telecom compromise can expose call detail records, subscriber locations and SMS content, and in some environments lawful intercept systems (blog.checkpoint.com).
   • Evasion: SparrowShell can integrate a modified Reptile rootkit that hides processes, files and network activity on Linux, and some SparrowDoor variants use WinDivert to intercept traffic so that malicious communications blend with legitimate services (blog.checkpoint.com).

   Remediation

   The vendor recommends the following measures (blog.checkpoint.com):

   • Keep an accurate inventory of internet-facing systems, patch known vulnerabilities quickly and monitor exposed servers for unusual processes, authentication events and connections.
   • Inspect websites and downloads, especially unexpected certificate fixes or software updates offered through a web page.
   • Monitor for malicious DLL loading, credential dumping, keylogging, persistence and misuse of legitimate administrative tools.
   • Restrict RDP, SMB and SSH to the systems and accounts that need them, and investigate abnormal administrative access.
   • Monitor DNS, command-and-control traffic and unusual outbound connections for backdoors and tunnelling.