CopperDragon - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/actors/copperdragon/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 10 Nov 2026 20:02:01 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgCopperDragon: Sparrow Malware Ecosystem and Espionage Campaignshttps://feed.craftedsignal.io/briefs/2026-11-sparrow-malware/Tue, 10 Nov 2026 20:02:01 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-sparrow-malware/Check Point Research identified three China-nexus espionage clusters (SilentDelivery, OceanGate, and DarkWire) linked by a shared malware ecosystem known as Sparrow. These clusters target telecommunications, government, military, research, and critical infrastructure across Latin America, Asia, and Europe.Check Point Research is tracking three distinct threat activity clusters: SilentDelivery, OceanGate, and DarkWire. These clusters, linked to the CopperDragon entity, utilize the Sparrow malware ecosystem.

  • SilentDelivery: Uses watering hole attacks with jsjiami-obfuscated JavaScript to distribute trojanized "Certificate Fix" utilities, deploying backdoors like SquadC and variants of SparrowDoor.
  • OceanGate: Targets Linux and Windows environments using backdoors (AnnobinDoor, SparrowShell) and post-exploitation tools (CopperAdu, CopperList, CopperLogger, CopperLsa). Kernel rootkits and WinDivert drivers have been observed to facilitate evasion and traffic interception.
  • DarkWire: Targets telecommunications and government entities in Latin America using tools like CopperLoader, CopperDoor, and CopperDNS (which uses DNS tunneling via MX queries).

CopperDragon is assessed to be a digital quartermaster for China-nexus actors including FamousSparrow, Earth Estries, Tropic Trooper, UAT-9244, and UAT-8302.

]]>highthreatChina-nexusEspionage