CopperDragon's Sparrow Framework Drives Global Campaigns

Check Point Research has traced CopperDragon as a China-nexus operator supplying the cross‑platform Sparrow framework to a set of campaigns across Latin America, Asia and Europe. The authors identify three distinct operational clusters—SilentDelivery, OceanGate and DarkWire—sharing infrastructure and code characteristics linked to Sparrow, and targeting telecommunications providers, government bodies, military entities and critical infrastructure.

CopperDragon is linked to multiple actors using Sparrow-based tools, including FamousSparrow, Earth Estries, TropicTrooper and UAT-9244, although the teams appear to operate with shared toolsets rather than a single unit.

SilentDelivery, active from early 2026, uses highly selective watering-hole attacks to install either SquadC or SparrowDoor, delivered via Trojanised MSI installers masquerading as certificate repair utilities. Victims include government, shipping, IT and research sites in Europe and Asia.

The infection chain involves compromising legitimate sites, replacing pages with a customised Chrome certificate warning, and prompting users to install the fake certificate before the next-stage payload is retrieved from compromised S3 buckets. The SquadC backdoor on Windows supports sandbox avoidance and in-memory loading, with a loader process and a set of commands for file operations, command execution and screenshots.

OceanGate, observed in 2025–2026, pivots from Linux to Windows. Linux implants include AnnobinDoor and SparrowShell, with lateral movement and credential theft followed by a Windows deployment based on SparrowDoor variants. Notably, SparrowShell exhibits cross‑platform design and shared RC4 keys with SparrowDoor, and operators use Trojanised SSH/SSH D tools and publicly available utilities to facilitate access.

DarkWire, tracked from mid‑2025, targets Latin American telecoms and government entities with CopperDoor and CopperDNS backdoors, plus loader‑based deployment and DLL sideloading. The report documents infrastructure patterns, TLS certificates, and domain impersonation tied to this activity, along with a broader set of CopperTools including CopperProxy, CopperLsass and CopperList.