A year-long Check Point Research investigation has connected three China-nexus cyber-espionage clusters targeting government, telecommunications and critical infrastructure organizations across Europe, Asia and Latin America. While parts of this activity have previously been reported separately, the wider investigation reveals new insights and connections through shared malware and infrastructure, pointing to a broader ecosystem linked to an entity Check Point Research tracks as “CopperDragon”.
CopperDragon may operate as a digital quartermaster, developing or supplying malware and infrastructure to multiple sophisticated China-nexus threat actors. By examining the connections between these campaigns, Check Point Research provides a broader view of an espionage ecosystem spanning Windows and Linux environments, multiple regions and some of the world’s most strategically important sectors.
Figure 1 – Geographic distribution of Sparrow framework victims.
Key Findings
- Check Point Research connected three operational clusters across Latin America, Asia and Europe, targeting government, telecom, military, research and critical infrastructure organizations.
- CopperDragon may act as a digital quartermaster, supplying malware and infrastructure to multiple China-nexus threat actors using the Sparrow framework.
- Activity was observed across 21 countries, with the research expanding known victimology and uncovering previously undocumented activity in Asia, including significant focus on India.
- Researchers uncovered previously undocumented Windows and Linux malware, including SquadC, AnnobinDoor and SparrowShell, alongside new details about the Sparrow framework.
- Attackers used different entry methods, from compromised internet-facing servers to selective watering-hole attacks involving fake browser certificate warnings.
What Is CopperDragon?
CopperDragon is the name Check Point Research uses to track the entity behind the Sparrow malware framework, which may serve as a developer and supplier supporting multiple China-nexus threat actors. The research suggests that malware and infrastructure associated with CopperDragon are being used across operations conducted by different China-nexus groups, rather than representing the activity of a single threat actor.
The picture began with FamousSparrow, previously linked to Salt Typhoon, a threat actor first identified in 2021 and associated with the SparrowDoor backdoor. In subsequent years, related malware and infrastructure appeared in activity associated with other China-nexus actors, including Earth Estries, TropicTrooper and UAT-9244. By examining these connections, Check Point Research identified signs of a common malware ecosystem that could be supporting multiple operators.
This distinction also matters for attribution. The presence of the same malware or command-and-control infrastructure across two intrusions does not necessarily mean they were conducted by the same threat actor. CopperDragon may instead represent a common supplier, helping explain why related tools and infrastructure appear across otherwise distinct espionage campaigns.
What Did Check Point Research Discover About CopperDragon?
The investigation connects activity that had previously been associated with separate campaigns and threat actors, providing a broader picture of how the Sparrow malware ecosystem is being used around the world. Check Point Research divided this activity into three operational clusters, SilentDelivery, OceanGate and DarkWire, based on differences in targeting, geography, malware and attack techniques.
The research also expands the known scope of the activity. Check Point Research identified a broader range of affected countries and sectors, uncovered previously undocumented activity in Asia with a particular focus on India, and discovered previously undocumented malware for both Windows and Linux. New findings include SquadC, AnnobinDoor and SparrowShell, alongside additional details about Sparrow’s passive backdoor and kernel-level capabilities.
Together, these findings support a broader view of CopperDragon as a possible digital quartermaster providing malware or infrastructure that different China-nexus operators can incorporate into their own campaigns. This provides another way to understand activity that could otherwise appear unrelated when examined as individual attacks.
Where Is CopperDragon Targeting Organizations?
Check Point Research observed CopperDragon-linked activity across 21 countries in Latin America, Europe and Asia, targeting telecommunications providers, government organizations, military entities, research institutions and critical infrastructure. The investigation separated the activity into three clusters based on their geography, tools and attack methods.
- SilentDelivery focuses primarily on Europe and Asia and uses highly selective watering-hole attacks, including in Germany, France and Czech Republic. Attackers compromise legitimate websites associated with sectors such as government, shipping, IT and research, then selectively present visitors with fraudulent Chrome certificate warnings. Victims who follow the instructions can be tricked into downloading a supposed certificate repair utility that instead installs the SquadC backdoor or, in some cases, a variant of SparrowDoor.
Figure 2 – SilentDelivery infection chain.
- OceanGate operates primarily in Asia and includes previously undocumented activity with a particular focus on India. In observed intrusions, attackers compromised internet-facing Linux systems and deployed custom backdoors before harvesting credentials and moving into Windows environments. The campaign provides additional insight into an area that has received comparatively limited attention: how Sparrow-related actors operate across Linux and Windows systems within the same intrusion.
Figure 3 – OceanGate cluster: Linux attack chain diagram.
- DarkWire has been concentrated primarily in Latin America, although more recent intrusions indicate activity beyond the region. It targets telecommunications providers and government organizations using newly identified malware including CopperDoor and CopperDNS, together with tools designed for credential harvesting, internal reconnaissance and network movement.
Figure 4 – DarkWire toolset.
Why Are Government and Telecommunications Organizations Being Targeted?
Government and telecommunications organizations can provide significant intelligence value to espionage operations. A compromise of a government network can expose sensitive information, credentials and communications, while sustained access can create opportunities for continued intelligence collection.
Telecommunications providers are uniquely valuable targets for cyber espionage. Compromise one, and attackers can see far beyond the provider itself. Depending on which systems they reach, they can collect call detail records (CDRs) that reveal who talks to whom, when, and for how long. They can track subscriber locations and read SMS messages. In some environments, access may extend to lawful intercept systems, exposing which people government and law-enforcement agencies are monitoring.
This makes the concentration of DarkWire activity in Latin America particularly significant. The targeting takes place against a backdrop of growing strategic and economic competition involving China, the United States and countries across the region. While the technical evidence does not establish geopolitical motivation for individual attacks, the intelligence value of telecommunications and government infrastructure makes these sectors important targets for sophisticated espionage operations.
How Does CopperDragon Compromise Organizations?
The three clusters show that CopperDragon-linked actors use multiple routes into targeted organizations rather than relying on one attack method. Their techniques range from the exploitation of vulnerable public-facing infrastructure to compromised websites and selective social engineering.
SilentDelivery provides one of the clearest examples. Attackers compromise legitimate websites and inject heavily obfuscated JavaScript that communicates with attacker-controlled infrastructure. Selected visitors can then be presented with a fake Chrome certificate error instructing them to install a certificate fix. The download instead delivers SquadC or, in some cases, SparrowDoor, allowing attackers to establish an initial foothold.
OceanGate demonstrates a different approach. Attackers initially exploit vulnerable internet-facing Linux systems and deploy custom malware including AnnobinDoor and SparrowShell. Trojanized SSH components can then capture credentials during administrative activity, allowing the attackers to move between Linux hosts and eventually into Windows environments.
Once inside Windows networks, the actors use additional tools for reconnaissance, credential theft and continued access. These include CopperLogger for capturing keystrokes and clipboard activity, CopperLsa for stealing authentication data and CopperList for collecting system and file information.
The research also identified techniques intended to make persistent access more difficult to detect. SparrowShell can integrate with a modified Reptile rootkit that hides processes, files and network activity on Linux, while some SparrowDoor variants use WinDivert to intercept network traffic. This allows malicious communications to blend with traffic associated with legitimate services and illustrates why visibility across endpoint, server and network activity is important when defending against advanced espionage operations.
Figure 5 – A fake Chrome certificate error page with an added “Install certificate” button.
Figure 6 – A newer version of Chrome’s certificate error appearing in different languages.
How Can Organizations Defend Against CopperDragon and Sparrow Malware?
The diversity of the CopperDragon campaigns shows why organizations need protection across networks, endpoints, email and internet-facing infrastructure. The observed attacks can begin with exploitation of an exposed server, a compromised website or spear phishing, and then progress through credential theft and lateral movement across both Linux and Windows environments.
Organizations should prioritize several defensive measures:
- Secure internet-facing infrastructure: Maintain an accurate inventory of exposed systems, rapidly patch known vulnerabilities and monitor internet-facing servers for unusual processes, authentication activity and connections.
- Protect users from malicious downloads,phishing and compromised websites: Security controls should inspect links, websites, files and downloads, particularly unexpected utilities such as certificate fixes or software updates delivered through a website.
- Detect credential theft and endpoint activity: Monitor for malicious DLL loading, credential dumping, keylogging, persistence mechanisms and suspicious use of otherwise legitimate administrative tools.
- Limit and monitor lateral movement: RDP, SMB and SSH activity should be restricted to systems and accounts that require them, with abnormal administrative access investigated promptly.
- Inspect network and DNS communications: Monitoring DNS, command-and-control traffic and unusual outbound connections can help expose backdoors, tunneling and other communications designed to blend into legitimate traffic.
For Check Point customers, Check Point Exposure Management can help organizations identify and prioritize weaknesses across their attack surface, particularly exposed and vulnerable assets that could provide an initial entry point. This is especially relevant to the CopperDragon campaigns, where exploitation of internet-facing infrastructure was one of the initial access methods observed by Check Point Research. It also finds lookalike domains, malicious phishing websites, and brand impersonations across apps, social media, and other channels, so security teams can take them down before attackers use them to reach employees or customers.
Check Point’s Workspace Security platform provides endpoint protection and behavioral detection that can help identify malware and post-exploitation activity such as those seen across the CopperDragon campaigns. In addition to identifying malware and post-exploitation activity on endpoints, its browser security capabilities help protect users against web-based threats, malicious sites and downloads, particularly relevant to the watering-hole attacks observed in SilentDelivery. Check Point Browser Security is positioned by Check Point as part of its Workspace Security and Endpoint Security offering. Check Point Email and Collaboration provides another layer of protection against phishing and malicious content used to establish initial access.
At the network layer, Check Point Network Security provides protections that can help detect and block malicious activity associated with these attack chains. Capabilities including Intrusion Prevention, Anti-Bot, Antivirus, Threat Emulation and DNS security provide coverage across exploitation attempts, malicious files and command-and-control communications.
The CopperDragon investigation highlights the importance of looking beyond an individual malware sample or threat-actor name. By identifying the shared framework and infrastructure behind seemingly separate operations, defenders can better understand how tools are moving through the wider China-nexus threat ecosystem and identify connections between attacks that might otherwise appear unrelated.
For the full technical analysis, read the research from Check Point Research here.
