Check Point links three campaigns to suspected China malware supplier

Three China-nexus intrusion campaigns across Latin America, Asia and Europe have been linked by Check Point Research (CPR) through shared malware and infrastructure to a possible common supplier of hacking tools, CPR’s November report states. The investigations cover a year and tie three clusters to a framework called Sparrow, suggesting a single actor or entity behind multiple operations.

The research names CopperDragon as the suspected supplier behind the Sparrow framework and notes it may also be involved in maintaining and supplying variants of the Melofee backdoor. The findings are aimed at tracking activity that has previously been grouped under the FamousSparrow umbrella.

The clusters are dubbed SilentDelivery, OceanGate and DarkWire. SilentDelivery, active since early 2026, compromised legitimate websites in government, shipping and IT or research sectors, delivering a fake Chrome certificate warning that prompted users to install a “Certificate Fix” utility; the compromise delivered SquadC or a SparrowDoor variant to establish initial footholds, with targets in the Czech Republic, Germany, France, Taiwan, Nepal, Hong Kong and Indonesia.

OceanGate appeared in 2025–2026, primarily targeting government organisations and critical infrastructure in Asia, beginning with an internet-facing Linux server before moving laterally into Windows environments to procure credentials, move within networks and exfiltrate sensitive operational information. DarkWire, first seen in mid-2025 and initially focused on Latin America, expanded to telecoms operators and foreign affairs and justice bodies, including at least three major providers in the region.

CPR notes that CopperDragon is not shown to share direct code with all toolsets used by DarkWire, but points to infrastructure linked to a FamousSparrow domain as part of the chain of associations.