"a potential digital quartermaster supporting China-nexus threat actors," Check Point Research wrote, describing a suspected supplier they call CopperDragon.
CopperDragon and the Sparrow framework
On November 10, Check Point Research (CPR) published a year-long investigation that links three distinct intrusion clusters to a shared toolset it calls the Sparrow framework. CPR presents CopperDragon as the Sparrow framework's "possible developer and supplier" and says the same actor is assessed to be involved in maintaining and supplying variants of the Melofee backdoor. The vendor framed CopperDragon not as a single hands-on operator but as "a potential digital quartermaster supporting China-nexus threat actors," supplying software and infrastructure to multiple groups.
Three clusters united by shared code and infrastructure
CPR tracks the connected activity as three clusters: SilentDelivery, OceanGate and DarkWire. The investigator linked these clusters through shared infrastructure features and code similarities found inside the Sparrow framework. FamousSparrow, a collection of tools first identified in 2021 and known for using the SparrowDoor backdoor, figures into CPR's analysis as another node in the toolkit lineage. CPR noted that Earth Estries, TropicTrooper and UAT-9244 use a shared toolset "potentially supplied by the same entity," and that FamousSparrow was previously linked to Salt Typhoon, though CPR says the details of that relationship remain unclear.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleSilentDelivery: poisoned websites and a fake "Certificate Fix"
SilentDelivery has been observed since early 2026. CPR says the cluster compromised legitimate websites—mainly in government, shipping, and IT or research sectors—and used them to display a fake Chrome certificate warning. That pop-up prompted visitors to install a "Certificate Fix" utility. When installed, the bogus utility delivered either SquadC or a SparrowDoor variant, giving attackers an initial foothold. CPR reported targeted countries for SilentDelivery as the Czech Republic, Germany, France, Taiwan, Nepal, Hong Kong and Indonesia.
OceanGate: Linux-facing entry, Windows lateral movement, and exfiltration
OceanGate was active during 2025 and 2026 and principally targeted government organizations and critical infrastructure across Asia. According to CPR, intrusions began through an internet-facing Linux server before the attackers moved into Windows environments. The operation included extensive credential theft, lateral movement, and exfiltration of sensitive operational information—behaviors consistent with a campaign seeking long-term, high-value access rather than short-lived disruption.
DarkWire: telecoms, justice and foreign affairs in Latin America
First identified in mid-2025, DarkWire initially concentrated on Latin America, and more recent intrusions suggest expansion beyond that early footprint. CPR says the cluster targeted telecom operators—including at least three major providers in the region—as well as foreign affairs and justice bodies. Unlike the other two clusters, CPR did not identify direct code similarities between DarkWire tooling and the CopperDragon/Sparrow toolset; the link rests instead on infrastructure connected to a previously reported FamousSparrow domain.
What this means for security teams, telecoms, and governments
- Security teams and incident responders: CPR's report ties diverse activity to a shared Sparrow framework and to CopperDragon as a supplier. Teams will likely focus on indicators tied to SparrowDoor variants and the Melofee backdoor family, watch for the fake Chrome certificate installation pattern used by SilentDelivery, and monitor infrastructure overlap with known FamousSparrow domains.
- Telecom operators: DarkWire's targeting of "at least three major providers" in Latin America places telecom firms squarely in the crosshairs; operators will need to trace the infrastructure links CPR identifies and assess whether previous compromises map to the same domains or tool variants.
- Governments and critical-infrastructure owners: OceanGate's use of an internet-facing Linux server to pivot into Windows environments—and its emphasis on credential theft and exfiltration of operational information—underscores the need to examine both internet-exposed services and identity protections, as CPR's findings link those behaviors to the Sparrow toolset ecosystem.
CPR cautions that shared malware and infrastructure "can blur the boundaries between operators and campaigns," and frames its findings as a way to refine tracking of activity long grouped under FamousSparrow. The practical question CPR leaves on the table is whether attribution can keep pace with an ecosystem model in which a single supplier outfits multiple distinct clusters. For defenders and investigators, the immediate task is clearer: map Sparrow-related indicators, flag the Fake Certificate Fix technique, and follow the FamousSparrow infrastructure seams CPR identified to separate operator activity from supplier tooling.
https://www.infosecurity-magazine.com/news/chinese-malware-tied-three-hacking/
