Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Ravie LakshmananNov 10, 2026Cyber Espionage / Malware Three distinct threat activity clusters with shared infrastructure and malware code similarities have been observed targeting telecommunications providers, government organizations, military entities, research institutions, and critical infrastructure across Latin America, Asia, and Europe over the past year. Check Point Research is tracking the clusters under the names SilentDelivery, OceanGate, and DarkWire. Although initially assumed to be independent sets of attacks, each with its own backdoors and post-exploitation tooling, they have all been linked through a malware ecosystem called Sparrow. The entity behind the Sparrow framework has been codenamed CopperDragon, and is assessed to be a digital quartermaster developing tools for China-nexus threat actors, including FamousSparrow, Earth Estries, Tropic Trooper, UAT-9244, and UAT-8302. "Each cluster employed a different toolset and different initial access techniques, including compromising internet-facing infrastructure and highly selective watering hole attacks," Check Point said in a technical report published today. "The compromised websites that were used for watering hole attacks were of government, shipping, and IT and research sectors." Attacks mounted by FamousSparrow are known for deploying backdoors like SparrowDoor (and its variants Crowdoor and TernDoor), SparroWocky, and HemiGate. It's also assessed to share some degree of overlap with Salt Typhoon. However, the precise nature of the relationship remains unclear. The cyber espionage ecosystem linked to CopperDragon is driven by three prominent clusters - SilentDelivery (Beginning in early 2026), which conducts highly selective watering hole attacks targeting Europe and Asia that distribute a backdoor called SquadC (aka SquawkDoor) through trojanized MSI installers masquerading as certificate repair utilities OceanGate (2025-2026), which primarily focuses on Asian organizations with a variant of SparrowDoor after obtaining initial access via internet-facing Linux servers and then moving laterally into Windows environments DarkWire (Mid 2025), which targets telecommunications providers and government organizations across Latin America using backdoors called CopperDoor (aka SparroWocky) and CopperDNS The SilentDelivery chain begins with the attacker injecting heavily obfuscated JavaScript into legitimate websites frequented by their intended targets. Visitors to the sites are greeted by a Google Chrome SSL certificate warning that instructs users to install a "Certificate Fix" utility to restore access. The so-called utility, once deployed, delivers either SquadC or a SparrowDoor variant. All the compromised websites have been found to be related to government, shipping, IT, and research sectors in the Czech Republic, Germany, France, Taiwan, Nepal, Hong Kong, and Indonesia. According to a report published by Positive Technologies in August 2026, there are indications that the campaign has also targeted entities in Egypt and the Philippines using this method. "The JavaScript injected into the compromised websites is heavily obfuscated using jsjiami, a publicly available JavaScript obfuscation service," Check Point said. "It first checks whether the user is running Windows and, in some cases, verifies that the website’s domain matches the intended compromised domain." The script then repeatedly sends status-check requests to a command-and-control (C2) server to fingerprint the user based on IP and geolocation, and ultimately decide whether to continue the attack and serve the fake warning. Written in C/C++, SquadC is a Windows backdoor that enables initial foothold over the infected host. It establishes persistence by means of a Windows Registry Run key that masquerades as a Windows update assistant. Further analysis has uncovered that the malware is also distributed via phishing emails targeting Indonesian organizations. The phishing email comes with a Windows Shortcut (LNK) disguised as a PDF document, which, when opened, abuses the legitimate "ftp.exe" binary to run a batch script that's responsible for displaying an empty file as a decoy, while launching SquadC via DLL sideloading. The OceanGate operation, on the other hand, has been observed targeting both Windows and Linux environments, deploying previously undocumented tooling to maintain access, move laterally across the network, and exfiltrate sensitive data. The Linux phase of the attack involves two new backdoors - AnnobinDoor, a Go-based backdoor that supports a wide array of features, such as remote access, interactive shell, file management, SOCKS proxying, SSH tunneling, port forwarding, and reverse connections, and enables the infected Linux machine to function as both a remote shell and an internal network pivot SparrowShell, a modular Linux backdoor that shares overlaps with its Windows counterpart, SparrowDoor "After harvesting credentials from multiple users and establishing a strong foothold in the Linux environment, the actor moved into the Windows environment," Check Point explained. "The actor attempted to log in to several Windows machines over RDP, trying different passwords until it successfully authenticated with an administrator account." This step is followed by the deployment of bespoke post-exploitation tools and a variant of SparrowDoor - CopperAdu, a post-exploitation tool which configures a compromised Windows machine for remote administrative access CopperList, a Windows reconnaissance tool for collecting host information, disk details, and a recursive file inventory, including file paths, sizes, and timestamps CopperLogger, a Raw Input-based keylogger to capture keyboard input events, along with monitoring clipboard activity, active window titles, and associated process names and paths CopperLsa, a utility that collects passwords, hashes, and authentication tokens from NTLM and Kerberos What's more, the threat actor has been found incorporating kernel rootkits and kernel-level access capabilities into SparrowDoor and SparrowShell to evade defenses through process hiding and to capture and manipulate network packet capture using WinDivert drivers. "The actor abused the driver to convert SparrowDoor into a passive backdoor that intercepts and manipulates packets at the kernel level, making its traffic less visible," Check Point said. "This allows the backdoor to listen internally on one port while receiving connections through an externally accessible port, such as 443, that is already used by a legitimate service." "The backdoor applies a strict filter to intercept connections from a specific source IP address to the legitimate service's port. It manipulates the packet and rewrites the destination port to the backdoor’s internal listening port, typically a high port such as 49628. For response traffic, it rewrites the source port back to the external service port, making the responses appear to originate from the legitimate service." Interestingly, SparrowShell shares code- and infrastructure-level similarities with a malware called Mélofée that was first described by ExaTrack in March 2023 as based on the open-source Reptile rootkit. This has raised the possibility that CopperDragon is also behind the development and supply of Mélofée. The third and last cluster of activity centers around Latin America, with a particular focus on telecommunications operators and government entities. These attacks led to the deployment of two newly identified backdoors called CopperDoor and CopperDNS as a possible replacement for SparrowDoor. Also supporting these operations is a set of custom tools - CopperLoader, a reflective loader typically deployed through DLL sideloading and is used to deliver additional tools, including CopperDoor, CopperDNS, CopperProxy, and CopperLsass CopperDoor, a memory-resident modular backdoor CopperDNS, a CopperDoor variant that communicates through DNS tunneling using MX queries PyProxy, a lightweight UDP relay written in Python CopperLsass, a dedicated module for dumping the LSASS process for credential harvesting "The operation heavily relies on DLL sideloading as a primary execution technique, often abusing executables that are not widely observed among other threat actors in the wild," Check Point said. "To minimize their footprint, the operators deliberately avoided creating new directories on disk, instead placing their tools within existing system paths." "CopperDoor infrastructure demonstrated a higher level of operational security. Most IP addresses were located in Latin America, often within the same country as the victim organization. This proximity likely helps the malicious traffic blend in with legitimate network activity and reduces the chances of detection." Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. cyber espionage, Linux security, Malware, Nation-State, network security, Threat Intelligence, Windows Security Hackers Target OpenSSH SSHole Flaw Within Hours of Disclosure, Gain Root on Honeypot The Collapsed Patch Window: Why Runtime Protection is Now Your First Line of Defense Against AI-Driven Attacks The Rise of the Threat Operator: How AI Will Redefine Security Operations and Careers Xen Hypervisor Flaws Let One Malicious VM Read and Write Any Other VM's Memory Red Hat Patches 9.8-Rated Linux TCP RCE Flaw While Ubuntu Releases Fixes for Testing Critical Rails Flaw Lets Attackers Write Server Files via Crafted ImageMagick Uploads Microsoft Paint RCE Fix Now Available, but Windows Update Won't Deliver It OpenAI AI Pipeline Generates 948 Linux Root Escalation Exploits in 30-Hour Run The Flood is Coming And The Pipes Were Already Full Hackers Hide Linux Backdoor in Control Web Panel Server to Execute Commands Without Logs 5 Active Cyber Threats That Put US Enterprises at Risk in October 2026 Synology NAS Devices Targeted in Ransomware Attacks Exploiting Patched DSM Flaw Google Disrupts 1.3 Million-Device Android Botnet, Says TV Box Maker Sold Criminal Access Is Your Exposure Management Platform Leaving You Exposed? Five Tests to Find Out OpenSSH Issues Emergency Fix for Flaw Letting Long Passwords Bypass SSH Auth on Alpine Linux Claude Code's “Don't Ask Again” File Exposes Passwords and Keys in 1,122 Public Copies on GitHub New Wave of Refrigeration Cyberattacks Hits Supermarkets Across Europe, Forcing Stores to Pull Food Apple to Start Scanning Publicly Shared iCloud Photos and Files for Harmful Content Binance Reveals How Fake Job Interviews and AI Tool Abuse Led to $6.43 Billion Theft ThreatsDay: Apache OFBiz RCE, DreamHost Breach, DeFi Site Hijacks + 17 More Stories Google Warns LLMjacking Attacks Are Costing Some Enterprises Up to $1 Million in Cloud Charges Google Issues Patches for Critical Android Flaw That Could Allow RCE Without User Interaction Debian and Ubuntu APT Flaw Lets MitM Attackers Swap Verified Packages and Run Code as Root CISA Confirms Hackers Exploiting WordPress Core Flaw During Software Upgrades See How Bitdefender GravityZone Identifies Shadow AI and Prioritizes Endpoint Risks Assess Your Organization's AI Code Sprawl Exposure With This Practical Guide Detect Lateral Movement and Evasive Attacks With Corelight's Open NDR Platform Beyond CVE Scanning: Book a Demo of Continuous AI-Powered Web Pentesting Your SOC Has an Identity Blind Spot. Here's How to Fix It Learn how to close critical identity visibility gaps in your SOC, detect hidden threats, and accelerate incident response across human, machine, and AI identities. Register Free Today Roadmap for AI-Ready Security Operations Evaluate Attack Surface Visibility With an AI Threat Readiness Framework Learn how to assess AI threat readiness, strengthen attack surface visibility, and prepare security operations for emerging threats in this practical webinar. Governance Sets the Ceiling on Your AI Security Program See the five moves that raise a Stage 2 Govern score to a defensible Stage 3. Uncover Identity Dark Matter: SACR Research Brief Eliminate the blind spots undermining your security. Download the SACR brief. BeyondTrust an 8X Gartner® Magic Quadrant™ Leader for PAM Gain clarity on the PAM market and understand why BeyondTrust is again a Leader. 11 Real Stories: How Identity Exposure Unlocks Active Attack Paths Map cross-domain privilege escalation to sever breach routes at key choke points. The Collapsed Patch Window: Why Runtime Protection is Now Your First Line of Defense Against AI-Driven Attacks Your Attack Surface Is Growing Faster Than Your Team Can Respond The MSP Margin Math Nobody's Doing: Your Next Technician Might Already be on Payroll PEDM vs. Standing Elevated Privileges: Control Access Without Flooding the Helpdesk