"Each cluster employed a different toolset and different initial access techniques, including compromising internet-facing infrastructure and highly selective watering hole attacks," Check Point said in a technical report published today.
How three campaigns were tied together by the Sparrow ecosystem
Check Point Research linked three activity clusters—SilentDelivery, OceanGate, and DarkWire—through shared infrastructure and overlapping malware code in a framework it calls Sparrow. The group behind Sparrow has been codenamed CopperDragon and is assessed to act as a digital quartermaster, developing and supplying tools to multiple China-nexus threat actors, including FamousSparrow, Earth Estries, Tropic Trooper, UAT-9244, and UAT-8302.
The clusters span distinct timelines and geographies: SilentDelivery began in early 2026 with selective watering hole attacks across Europe and Asia; OceanGate operated through 2025–2026 primarily against Asian organizations and blended Linux and Windows tooling; DarkWire was active from mid-2025 and focused on telecommunications providers and government entities in Latin America.
SilentDelivery: watering holes, fake certificate fixes, and SquadC
SilentDelivery uses heavily obfuscated JavaScript injected into legitimate websites frequented by targets. The script—obfuscated with the publicly available jsjiami service—checks for Windows hosts and sometimes confirms the domain before repeatedly fingerprinting visitors by IP and geolocation. When conditions are met, visitors receive a Google Chrome SSL warning instructing them to install a counterfeit "Certificate Fix" utility.
The faux utility installs either SquadC (aka SquawkDoor) or a SparrowDoor variant. SquadC is a C/C++ Windows backdoor that persists via a Registry Run key disguised as a Windows update assistant. Check Point also found the malware distributed by phishing emails that include a Windows Shortcut (LNK) disguised as a PDF; opening it abuses the legitimate ftp.exe binary to run a batch script that decoys the user while launching SquadC via DLL sideloading.
Compromised websites in SilentDelivery were linked to government, shipping, IT and research sectors in the Czech Republic, Germany, France, Taiwan, Nepal, Hong Kong, and Indonesia. Positive Technologies reported in August 2026 indications the campaign also targeted entities in Egypt and the Philippines.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleOceanGate: Linux footholds, SparrowShell, and kernel-level evasions
OceanGate begins on internet-facing Linux servers and deploys two Linux backdoors: AnnobinDoor, a Go-based tool that provides remote access, interactive shell, file management, SOCKS proxying, SSH tunneling, port forwarding and reverse connections; and SparrowShell, a modular Linux backdoor with overlaps to its Windows counterpart, SparrowDoor.
After harvesting credentials and establishing a Linux foothold, the actor pivoted to Windows by attempting logins over RDP until authenticating as an administrator. Post-exploitation tooling includes CopperAdu (for configuring remote administrative access), CopperList (reconnaissance and recursive file inventory), CopperLogger (a Raw Input keylogger plus clipboard and active-window monitoring), and CopperLsa (collection of passwords, hashes and authentication tokens from NTLM and Kerberos).
OceanGate operators have incorporated kernel rootkits and kernel-level access into SparrowDoor and SparrowShell—using techniques such as WinDivert driver abuse—to hide processes and intercept or rewrite network packets so malicious traffic looks like legitimate service traffic. Check Point also notes SparrowShell shares code and infrastructure similarities with Mélofée, which ExaTrack described in March 2023 as based on the open-source Reptile rootkit.
DarkWire: telecoms and CopperDoor variants in Latin America
DarkWire targeted telecommunications providers and government organizations across Latin America and deployed a family of tools built around CopperDoor. Core components include CopperLoader (a reflective loader deployed via DLL sideloading), CopperDoor (a memory-resident modular backdoor), CopperDNS (a CopperDoor variant communicating via DNS tunneling using MX queries), CopperProxy (a SOCKS5 proxy), PyProxy (a Python UDP relay), and CopperLsass (an LSASS dumper for credentials).
Operators favored DLL sideloading and left minimal disk footprints, placing tools within existing system paths and avoiding new directories. Check Point observed higher operational security in CopperDoor infrastructure: most IP addresses were in Latin America and often located in the same country as the victim, a proximity likely intended to blend malicious traffic with legitimate network activity and reduce detection risk.
What this means for technologists and security teams, telecommunications operators, and government organizations
- Technologists and security teams: Expect multi-platform campaigns that begin on Linux and pivot to Windows, use kernel-level evasions (including WinDivert abuse), and employ DLL sideloading and deceptive installer workflows—detection must extend to driver and packet-manipulation behaviors, credential harvesting tools, and reflective loading patterns.
- Telecommunications operators: DarkWire’s focus on telcos and the use of locally proximate infrastructure to blend traffic means operators should scrutinize anomalous DNS MX queries, atypical in-country IP usage, and in-memory backdoors such as CopperDoor and CopperDNS.
- Government organizations: SilentDelivery’s targeted watering holes and fake certificate fixes demonstrate that highly selective web compromise and decoy installers remain effective—monitor for obfuscated JavaScript (jsjiami) injections, suspicious installer behaviors (trojanized MSI), and LNK-based phishing that abuses signed system binaries like ftp.exe.
Conclusion
Check Point’s analysis frames CopperDragon not as a single operator but as a tooling ecosystem: a digital quartermaster equipping multiple China-nexus groups with Sparrow-based backdoors and post-exploitation implants. The linkage across SilentDelivery, OceanGate, and DarkWire—spanning watering holes, Linux pivoting, kernel-level hiding, DNS tunneling, and DLL sideloading—underscores how a shared development pipeline can produce tailored campaigns for distinct objectives and regions. Notably, the report leaves relationships—such as the overlap with Salt Typhoon and CopperDragon’s possible role in Mélofée—described but not fully resolved, making further technical tracking and cross-lab correlation an immediate priority.
Original report: https://thehackernews.com/2026/11/three-china-nexus-espionage-campaigns.html
