Check Point links three China espionage clusters through Sparrow

Check Point Research has linked three China-nexus espionage clusters—SilentDelivery, OceanGate, and DarkWire—through a shared Sparrow malware ecosystem, CopperDragon, which researchers describe as a digital “quartermaster” for China-aligned actors.

The clusters, observed targeting telecommunications providers, government bodies, military institutes, research organisations and critical infrastructure across Latin America, Asia and Europe over the past year, were previously thought separate but are now shown to share tooling and infrastructure.

SilentDelivery began in early 2026 with obfuscated JavaScript injected into legitimate sites, delivering SquadC (also known as SparrowDoor) or SparrowDoor variants via trojanised MSI installers masquerading as certificate repair utilities. The compromised sites have targeted the Czech Republic, Germany, France, Taiwan, Nepal, Hong Kong and Indonesia, with possible additional targeting in Egypt and the Philippines noted in a Positive Technologies report.

OceanGate and DarkWire extend the campaign across Linux and Windows environments and Latin American telecoms and government targets, respectively. OceanGate incorporates Linux-based backdoors AnnobinDoor and SparrowShell, then moves into Windows via RDP after credential harvesting, and deploys SparrowDoor variants such as CopperAdu, CopperList, CopperLogger and CopperLsa for post-exploitation.

DarkWire deploys backdoors CopperDoor and CopperDNS, plus CopperLoader and associated tools, using DLL sideloading and tightly controlled on-disk footprints. The Sparrow ecosystem is also linked to broader overlaps with Salt Typhoon, while CopperDragon is associated with the FamousSparrow family and related tools. Check Point emphasises the use of government, shipping and IT/research watering holes and a combination of highly selective initial access methods and backdoor deployment to blend into normal traffic.