Check Point links three espionage campaigns to CopperDragon

Check Point Research has linked three ostensibly distinct cyber‑espionage campaigns—SilentDelivery, OceanGate and DarkWire—into a single cross‑platform toolkit driven by the CopperDragon Sparrow framework. The firms say CopperDragon serves as a central supplier for multiple China‑nexus threat groups using Sparrow cross‑platform malware for Linux and Windows.

Independent analyses from ESET and Positive Technologies corroborate overlaps in the tooling, and Check Point notes that the Sparrow framework and related server certificates tie the activity together, dating back to incidents over the past year across Latin America, Europe and Asia.

SilentDelivery began in early 2026 with watering‑hole compromises of government, shipping and IT sites in Europe and Asia. A compromised site served a jsjiami‑obfuscated script that fingerprinted IPs and displayed a fake local‑language Chrome SSL warning, prompting users to install a trojanised MSI from an Amazon S3 bucket.

The delivered payload could be SparrowDoor or a new C/C++ backdoor named SquadC, with SquadC designed to detect virtual machines and only run when a browser process is open; an Indonesian RAR archive also delivered SquadC via a malicious LNK that abused ftp.exe.

OceanGate operated from 2025 to 2026, breaching Linux servers, deploying AnnobinDoor and SparrowShell, and then pivoting to Windows via RDP to deploy CopperAdu, CopperList, CopperLogger and CopperLsa, with some SparrowDoor samples embedding the WinDivert driver to covertly intercept traffic. DarkWire, active from mid‑2025 in Latin America, used CopperLoader to decrypt payloads, delivering CopperDoor and CopperDNS, with additional tools such as CopperProxy, PyProxy and CopperLsass.