CopperDragon: Sparrow Malware Ecosystem and Espionage Campaigns
Check Point Research identified three China-nexus espionage clusters (SilentDelivery, OceanGate, and DarkWire) linked by a shared malware ecosystem known as Sparrow. These clusters target telecommunications, government, military, research, and critical infrastructure across Latin America, Asia, and Europe.
Triage facts
Revision 1- Applicability
- Windows, Linux
- Evidence
- Confirmed activeHigh confidence
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 10, 20:02 UTC
- Source quality
- B2Very likely
Check Point Research is tracking three distinct threat activity clusters: SilentDelivery, OceanGate, and DarkWire. These clusters, linked to the CopperDragon entity, utilize the Sparrow malware ecosystem.
- SilentDelivery: Uses watering hole attacks with jsjiami-obfuscated JavaScript to distribute trojanized "Certificate Fix" utilities, deploying backdoors like SquadC and variants of SparrowDoor.
- OceanGate: Targets Linux and Windows environments using backdoors (AnnobinDoor, SparrowShell) and post-exploitation tools (CopperAdu, CopperList, CopperLogger, CopperLsa). Kernel rootkits and WinDivert drivers have been observed to facilitate evasion and traffic interception.
- DarkWire: Targets telecommunications and government entities in Latin America using tools like CopperLoader, CopperDoor, and CopperDNS (which uses DNS tunneling via MX queries).
CopperDragon is assessed to be a digital quartermaster for China-nexus actors including FamousSparrow, Earth Estries, Tropic Trooper, UAT-9244, and UAT-8302.