CopperDragon: China-nexus malware supplier links SilentDelivery, OceanGate and DarkWire espionage clusters worldwide
Matéria consolidada. Reúne 5 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 4 fontes trouxeram em 11/11/2026 12:21; os links antigos trazem para cá.
Fontes: gbhackers.com ↗ thehackernews.com ↗ research.checkpoint.com ↗ blog.checkpoint.com ↗
A year-long Check Point Research investigation uncovered an interconnected espionage ecosystem tied to the entity CopperDragon, published on 2026-11-10 (blog.checkpoint.com, research.checkpoint.com). It targets government, telecom, military and critical infrastructure organizations in Latin America, Asia and Europe. CopperDragon appears to act as a malware and infrastructure supplier to several China-nexus actors, including FamousSparrow, Earth Estries, TropicTrooper and UAT-9244 (research.checkpoint.com), which complicates attribution (blog.checkpoint.com). The activity splits into three clusters, SilentDelivery, OceanGate and DarkWire, which share malware code and infrastructure and are linked through a malware ecosystem called Sparrow (thehackernews.com). Follow-up coverage on 2026-11-11 adds more malware family names and defensive advice (gbhackers.com).
Detalhes técnicos
- Initial access varies by cluster: watering-hole compromises, exploitation of internet-facing infrastructure and phishing (thehackernews.com). Spear-phishing and Linux server breaches are also reported (gbhackers.com).
- Post-compromise activity includes credential theft, lateral movement across Windows and Linux environments, kernel rootkits and kernel-level packet filtering (research.checkpoint.com, thehackernews.com).
- Malware is cross-platform and includes SquadC and SparrowDoor (research.checkpoint.com). Other families named are CopperDoor and CopperDNS (thehackernews.com), and CopperAdu, CopperLogger, CopperLsa and CopperDNS (gbhackers.com). The malware is described as modular (gbhackers.com).
- Shared code and infrastructure across clusters point to a coordinated ecosystem rather than isolated campaigns (research.checkpoint.com).
- Defenders should watch for DLL sideloading and unusual DLLs (gbhackers.com).
Remediação
- Prioritize patching internet-facing services (gbhackers.com).
- Monitor for DLL sideloading and unusual DLLs (gbhackers.com).
- Review Windows and Linux servers for the malware families listed above. The sources provide no IOCs, CVEs or other specific detection guidance.
Relatos divergentes
- Malware naming: the blog post lists SquadC, AnnobinDoor and SparrowShell (blog.checkpoint.com). The research report and the other outlets name SparrowDoor instead (research.checkpoint.com, thehackernews.com, gbhackers.com). The sources do not say whether these are different families or alternate names. The research report (research.checkpoint.com) is the more detailed technical source.
- Tool lists differ by outlet: thehackernews.com names CopperDoor and CopperDNS, while gbhackers.com names CopperAdu, CopperLogger, CopperLsa and CopperDNS. These are likely partial lists of the same toolset, but the sources do not confirm this.
- Attribution wording: the sources variously call CopperDragon an "entity", a supplier of malware and infrastructure, and a developer of tools for Chinese-aligned actors. The named client actors appear only in research.checkpoint.com and, partially, gbhackers.com.
Linha do tempo
-
China-Linked CopperDragon Malware Framework Targets Critical Infrastructure Globally
ler a análise desta fonte ocultar
Research links the CopperDragon framework to multiple China-nexus espionage campaigns, targeting critical infrastructure across Europe, Asia, and Latin America. The framework supplies malware and tools to various threat actors, including FamousSparrow and TropicTrooper, operating through clusters like SilentDelivery, OceanGate, and DarkWire. Campaigns involve watering-hole attacks, spear-phishing, and Linux server breaches, deploying modular malware such as SparrowDoor, CopperAdu, CopperLogger, CopperLsa, and CopperDNS. Defenders should prioritize patching internet-facing services and monitoring for DLL sideloading and unusual DLLs.
-
Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem
ler a análise desta fonte ocultar
Check Point Research identified three distinct threat clusters—SilentDelivery, OceanGate, and DarkWire—targeting various sectors across Latin America, Asia, and Europe, linked through a malware ecosystem called Sparrow. The campaigns involve different initial access techniques such as watering hole attacks, exploitation of internet-facing infrastructure, and phishing. The malware ecosystem is associated with a group called CopperDragon, believed to develop tools for Chinese-aligned threat actors, and includes malware variants like SquadC, SparrowDoor, CopperDoor, and CopperDNS. These operations demonstrate sophisticated techniques including kernel rootkits, kernel-level packet filtering, and lateral movement across Windows and Linux environments.
-
Uncovering CopperDragon's Global Espionage Network Targeting High-Profile Sectors
ler a análise desta fonte ocultar
Check Point Research conducted a year-long investigation revealing a widespread espionage operation attributed to the entity 'CopperDragon,' which supports multiple China-nexus threat actors such as FamousSparrow, Earth Estries, TropicTrooper, and UAT-9244. The operation involves three distinct clusters—SilentDelivery, OceanGate, and DarkWire—targeting telecommunications, government, military, and critical infrastructure organizations across Latin America, Asia, and Europe. These clusters employ a variety of malware and attack techniques, including watering-hole compromises, cross-platform backdoors like SparrowDoor and SquadC, credential theft, lateral movement, and kernel rootkits, often sharing infrastructure and malware code, indicating a coordinated ecosystem.
-
CopperDragon: Broader China-Nexus Cyber Espionage Framework Uncovered
ler a análise desta fonte ocultar
A year-long investigation by Check Point Research has revealed an interconnected espionage ecosystem linked to the entity 'CopperDragon,' targeting government, telecom, military, and critical infrastructure worldwide. Multiple clusters of activity across Latin America, Asia, and Europe demonstrate a wide-reaching operation using shared malware and infrastructure, including Windows and Linux malware like SquadC, AnnobinDoor, and SparrowShell. The research suggests CopperDragon acts as a malware and infrastructure supplier for various China-nexus threat actors, complicating attribution efforts.