{"id":4100,"date":"2026-11-10T23:26:36","date_gmt":"2026-11-10T23:26:36","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=4100"},"modified":"2026-11-10T23:26:36","modified_gmt":"2026-11-10T23:26:36","slug":"three-china-nexus-espionage-campaigns-linked-through-sparrow-malware-ecosystem","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=4100","title":{"rendered":"Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem"},"content":{"rendered":"<div id=\"articlebody\">\n<div class=\"separator\" style=\"clear: both;\"><a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEhJzh3KQXtsNe_Hb53sMmMSiGIRHL-ybly73FQY1F-RNeFR181cAeiYkvBDi80Upvlea0WqHLNW6ydto2DhfeD3PlISviNhaTUtVBdQMziXOtKybeWLKj7O3UmmeKP0vGX5ufVBkf1dbShyphenhyphenXgawm2sMttXPfbTTDtmYxbXo7Lw0jkGXtt-E-X7W7PtNxfD-\/s1700-nu-rw-lo-l85-e365\/chinese-telecom.jpg\" style=\"display: block;  text-align: center; clear: left; float: left;\"><\/a><\/div>\n<p>Three distinct threat activity clusters with shared infrastructure and malware code similarities have been observed targeting telecommunications providers, government organizations, military entities, research institutions, and critical infrastructure across Latin America, Asia, and Europe over the past year.<\/p>\n<p>Check Point Research is <a href=\"https:\/\/research.checkpoint.com\/2026\/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe\/\" target=\"_blank\">tracking<\/a> the clusters under the names <strong>SilentDelivery<\/strong>, <strong>OceanGate<\/strong>, and <strong>DarkWire<\/strong>. Although initially assumed to be independent sets of attacks, each with its own backdoors and post-exploitation tooling, they have all been linked through a malware ecosystem called Sparrow.<\/p>\n<p>The entity behind the Sparrow framework has been codenamed <strong>CopperDragon<\/strong>, and is assessed to be a digital quartermaster developing tools for China-nexus threat actors, including FamousSparrow, Earth Estries, Tropic Trooper, UAT-9244, and UAT-8302.<\/p>\n<p>\u00abEach cluster employed a different toolset and different initial access techniques, including compromising internet-facing infrastructure and highly selective watering hole attacks,\u00bb Check Point said in a technical report published today. \u00abThe compromised websites that were used for watering hole attacks were of government, shipping, and IT and research sectors.\u00bb<\/p>\n<p>Attacks mounted by FamousSparrow are known for deploying backdoors like SparrowDoor (and its variants Crowdoor and TernDoor), SparroWocky, and HemiGate. It&#8217;s also assessed to share some degree of overlap with Salt Typhoon. However, the precise nature of the relationship remains unclear.<\/p>\n<div class=\"dog_two clear\">\n<div class=\"cf\"><a href=\"https:\/\/thehackernews.uk\/ai-governance-platform-d\" rel=\"nofollow noopener sponsored\" target=\"_blank\"><img loading=\"lazy\" decoding=\"async\" class=\"lazyload\" alt=\"Cybersecurity\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEi9hjzSN2bSutSbaNO6ZWEm02wC6hue03kC4VKPSfsdPvcDX2PAvPE-u9QrLCw3POvN3hXFPlyYyFgkAgtKrs4I2oSb9BkIFOWQ_k1ISfIBdT2AoWNvq2Q2DF_3AyA4fJriKPHkTjqYFxu-Y_H4IH9uqscX8lh-puQ5cPmc_veAEr9p4fC0497XT8Fktlp6\/s728-nu-rw-lo-l85-e365\/tl-insidem-d.jpg\" width=\"729\" height=\"91\"\/><\/a><\/div>\n<\/div>\n<p>The cyber espionage ecosystem linked to CopperDragon is driven by three prominent clusters &#8211;<\/p>\n<ul>\n<li><strong>SilentDelivery<\/strong> (Beginning in early 2026), which conducts highly selective watering hole attacks targeting Europe and Asia that distribute a backdoor called SquadC (aka SquawkDoor) through trojanized MSI installers masquerading as certificate repair utilities<\/li>\n<li><strong>OceanGate<\/strong> (2025-2026), which primarily focuses on Asian organizations with a variant of SparrowDoor after obtaining initial access via internet-facing Linux servers and then moving laterally into Windows environments<\/li>\n<li><strong>DarkWire<\/strong> (Mid 2025), which targets telecommunications providers and government organizations across Latin America using backdoors called <a href=\"https:\/\/thehackernews.com\/2026\/09\/china-aligned-famoussparrow-deploys.html\" target=\"_blank\">CopperDoor (aka SparroWocky) and CopperDNS<\/li>\n<\/ul>\n<h3>SilentDelivery<\/h3>\n<p>The SilentDelivery chain begins with the attacker injecting heavily obfuscated JavaScript into legitimate websites frequented by their intended targets. Visitors to the sites are greeted by a Google Chrome SSL certificate warning that instructs users to install a \u00abCertificate Fix\u00bb utility to restore access.<\/p>\n<p>The so-called utility, once deployed, delivers either SquadC or a SparrowDoor variant. All the compromised websites have been found to be related to government, shipping, IT, and research sectors in the Czech Republic, Germany, France, Taiwan, Nepal, Hong Kong, and Indonesia.<\/p>\n<div class=\"separator\" style=\"clear: both;\"><a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEjYB2LhkkboC2cO9fEWQqLzu_385A45NccNKIlBewxztS7Z5r0Efa2hSne6g3EXzMxyk518ajlfApZmqeWBJE0ca5BS-s6YCGmt7rcpcDZ377rXQdsYL8_XaypC7lN3RAK7qT0QmZh0bfh30t3Xst1N2tLQzCVb7X2k1mOGtjRMX3VwFh2OmjrVbsP1NGGl\/s1700-nu-rw-lo-l85-e365\/SilentDelivery.png\" style=\"clear: left; display: block; float: left;  text-align: center;\"><img decoding=\"async\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEjYB2LhkkboC2cO9fEWQqLzu_385A45NccNKIlBewxztS7Z5r0Efa2hSne6g3EXzMxyk518ajlfApZmqeWBJE0ca5BS-s6YCGmt7rcpcDZ377rXQdsYL8_XaypC7lN3RAK7qT0QmZh0bfh30t3Xst1N2tLQzCVb7X2k1mOGtjRMX3VwFh2OmjrVbsP1NGGl\/s1700-nu-rw-lo-l85-e365\/SilentDelivery.png\" alt=\"\" border=\"0\" data-original-height=\"410\" data-original-width=\"1024\"\/><\/a><\/div>\n<p>According to a report <a href=\"https:\/\/medium.com\/@dzaripova1177\/the-sparrow-that-chirped-too-loud-famoussparrow-attacks-using-updated-sparrowdoor-and-the-new-29ac2d90544d\" target=\"_blank\">published<\/a> by Positive Technologies in August 2026, there are indications that the campaign has also targeted entities in Egypt and the Philippines using this method.<\/p>\n<p>\u00abThe JavaScript injected into the compromised websites is heavily obfuscated using jsjiami, a publicly available JavaScript obfuscation service,\u00bb Check Point said. \u00abIt first checks whether the user is running Windows and, in some cases, verifies that the website\u2019s domain matches the intended compromised domain.\u00bb<\/p>\n<p>The script then repeatedly sends status-check requests to a command-and-control (C2) server to fingerprint the user based on IP and geolocation, and ultimately decide whether to continue the attack and serve the fake warning.<\/p>\n<table cellpadding=\"0\" cellspacing=\"0\" class=\"tr-caption-container\" style=\"float: left;\">\n<tbody>\n<tr>\n<td style=\"text-align: center;\"><a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEhJ63iWVqE759ibgdshHjX9u3NccRD8QYqWtJIO8T_3R42wogal5oPHaqeMOvYZzHqsvWqVlKs4TylFgmOGqBFrHLHObv_rvrA-_xrG3kPvd03hQlEmlNmcocNh-SCV0MJOOVG3Mg-58of3TV2AK7sgaik3YWpimSBHhQPUUskSTeOWoWIvXz_BCXGCWO4i\/s1700-nu-rw-lo-l85-e365\/shared.jpg\" style=\"clear: left; display: block; margin-left: auto; margin-right: auto;  text-align: center;\"><img decoding=\"async\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEhJ63iWVqE759ibgdshHjX9u3NccRD8QYqWtJIO8T_3R42wogal5oPHaqeMOvYZzHqsvWqVlKs4TylFgmOGqBFrHLHObv_rvrA-_xrG3kPvd03hQlEmlNmcocNh-SCV0MJOOVG3Mg-58of3TV2AK7sgaik3YWpimSBHhQPUUskSTeOWoWIvXz_BCXGCWO4i\/s1700-nu-rw-lo-l85-e365\/shared.jpg\" alt=\"\" border=\"0\" data-original-height=\"639\" data-original-width=\"961\"\/><\/a><\/td>\n<\/tr>\n<tr>\n<td class=\"tr-caption\" style=\"text-align: center;\">Source: Positive Technologies<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>Written in C\/C++, SquadC is a Windows backdoor that enables initial foothold over the infected host. It establishes persistence by means of a Windows Registry Run key that masquerades as a Windows update assistant. Further analysis has uncovered that the malware is also distributed via phishing emails targeting Indonesian organizations.<\/p>\n<p>The phishing email comes with a Windows Shortcut (LNK) disguised as a PDF document, which, when opened, abuses the legitimate \u00abftp.exe\u00bb binary to run a batch script that&#8217;s responsible for displaying an empty file as a decoy, while launching SquadC via DLL sideloading.<\/p>\n<h3>OceanGate<\/h3>\n<p>The OceanGate operation, on the other hand, has been observed targeting both Windows and Linux environments, deploying previously undocumented tooling to maintain access, move laterally across the network, and exfiltrate sensitive data.<\/p>\n<p>The Linux phase of the attack involves two new backdoors &#8211;<\/p>\n<ul>\n<li><strong>AnnobinDoor<\/strong>, a Go-based backdoor that supports a wide array of features, such as remote access, interactive shell, file management, SOCKS proxying, SSH tunneling, port forwarding, and reverse connections, and enables the infected Linux machine to function as both a remote shell and an internal network pivot<\/li>\n<li><strong>SparrowShell<\/strong>, a modular Linux backdoor that shares overlaps with its Windows counterpart, SparrowDoor<\/li>\n<\/ul>\n<p>\u00abAfter harvesting credentials from multiple users and establishing a strong foothold in the Linux environment, the actor moved into the Windows environment,\u00bb Check Point explained. \u00abThe actor attempted to log in to several Windows machines over RDP, trying different passwords until it successfully authenticated with an administrator account.\u00bb<\/p>\n<div class=\"separator\" style=\"clear: both;\"><a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEhMgD1MjHYhpZT3h_xqlBe4hGXJL5_OxwNjc_qpKWdGpyGUB6uZr1tFgm3Pnf0hqVXU4NOjiqX9jWrWQ2PjRe1_tNI2aw2_-hqjWoD7Mc08726rKfdfF6LCTQmsI7HoBj2rl_Jt2HOgzclrp3IsX1Rdh_N0xxXEmgmGzTSyOMFye6NXfsi4eokWUfyW86Td\/s1700-nu-rw-lo-l85-e365\/OceanGate.png\" style=\"clear: left; display: block; float: left;  text-align: center;\"><img decoding=\"async\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEhMgD1MjHYhpZT3h_xqlBe4hGXJL5_OxwNjc_qpKWdGpyGUB6uZr1tFgm3Pnf0hqVXU4NOjiqX9jWrWQ2PjRe1_tNI2aw2_-hqjWoD7Mc08726rKfdfF6LCTQmsI7HoBj2rl_Jt2HOgzclrp3IsX1Rdh_N0xxXEmgmGzTSyOMFye6NXfsi4eokWUfyW86Td\/s1700-nu-rw-lo-l85-e365\/OceanGate.png\" alt=\"\" border=\"0\" data-original-height=\"479\" data-original-width=\"1024\"\/><\/a><\/div>\n<p>This step is followed by the deployment of bespoke post-exploitation tools and a variant of SparrowDoor &#8211;<\/p>\n<ul>\n<li><strong>CopperAdu<\/strong>, a post-exploitation tool which configures a compromised Windows machine for remote administrative access<\/li>\n<li><strong>CopperList<\/strong>, a Windows reconnaissance tool for collecting host information, disk details, and a recursive file inventory, including file paths, sizes, and timestamps<\/li>\n<li><strong>CopperLogger<\/strong>, a Raw Input-based keylogger to capture keyboard input events, along with monitoring clipboard activity, active window titles, and associated process names and paths<\/li>\n<li><strong>CopperLsa<\/strong>, a utility that collects passwords, hashes, and authentication tokens from NTLM and Kerberos<\/li>\n<\/ul>\n<p>What&#8217;s more, the threat actor has been found incorporating kernel rootkits and kernel-level access capabilities into SparrowDoor and SparrowShell to evade defenses through process hiding and to capture and manipulate network packet capture using WinDivert drivers.<\/p>\n<p>\u00abThe actor abused the driver to convert SparrowDoor into a passive backdoor that intercepts and manipulates packets at the kernel level, making its traffic less visible,\u00bb Check Point said. \u00abThis allows the backdoor to listen internally on one port while receiving connections through an externally accessible port, such as 443, that is already used by a legitimate service.\u00bb<\/p>\n<p>\u00abThe backdoor applies a strict filter to intercept connections from a specific source IP address to the legitimate service&#8217;s port. It manipulates the packet and rewrites the destination port to the backdoor\u2019s internal listening port, typically a high port such as 49628. For response traffic, it rewrites the source port back to the external service port, making the responses appear to originate from the legitimate service.\u00bb<\/p>\n<div class=\"dog_two clear\">\n<div class=\"cf\"><a href=\"https:\/\/thehackernews.uk\/network-defense-dd\" rel=\"nofollow noopener sponsored\" target=\"_blank\"><img loading=\"lazy\" decoding=\"async\" class=\"lazyload\" alt=\"Cybersecurity\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEiWypk5aSrjVVXdRpyJaxKDe9VERLYId6cVdoZUwHGSe-EMh90qROsc-jk3uEKqB8-L4eSpBaka7err1zF86IrsEA4S2IZ8yyEsoZTsiGq2YvGuaCtdFvE8-ej7uEBhLbYJNENjs9umU6qmZCJ1aAzvG-ZDO0NtTVddy5hIGv4FBpDJp8UeOxYEzF5AeuK1\/s728-nu-rw-lo-l85-e36\/core-d.png\" width=\"729\" height=\"91\"\/><\/a><\/div>\n<\/div>\n<p>Interestingly, SparrowShell shares code- and infrastructure-level similarities with a malware called M\u00e9lof\u00e9e that was first described by ExaTrack in March 2023 as based on the open-source Reptile rootkit. This has raised the possibility that CopperDragon is also behind the development and supply of M\u00e9lof\u00e9e.<\/p>\n<h3>DarkWire<\/h3>\n<p>The third and last cluster of activity centers around Latin America, with a particular focus on telecommunications operators and government entities. These attacks led to the deployment of two newly identified backdoors called CopperDoor and CopperDNS as a possible replacement for SparrowDoor.<\/p>\n<div class=\"separator\" style=\"clear: both;\"><a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEj5xxQ3J6Cc7jHNxXcxWUjFUoPhZfVy8aeDaAPCu_AMIMEMZnl7bAgz70-hvrpQl0L5m0NXnLAQaU_ibOKNMXJzjFq9Dm6Kf4Tv0azdTuWD4ghy1pdhwqsaINMOwnZlTWGCSuP-4Oq77FZQEq5u0sH0mw73Ly-hzOvHpaHiy-zfFZQyaElwM2Gtv1zqHe6k\/s1700-nu-rw-lo-l85-e365\/DarkWire.png\" style=\"clear: left; display: block; float: left;  text-align: center;\"><img decoding=\"async\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEj5xxQ3J6Cc7jHNxXcxWUjFUoPhZfVy8aeDaAPCu_AMIMEMZnl7bAgz70-hvrpQl0L5m0NXnLAQaU_ibOKNMXJzjFq9Dm6Kf4Tv0azdTuWD4ghy1pdhwqsaINMOwnZlTWGCSuP-4Oq77FZQEq5u0sH0mw73Ly-hzOvHpaHiy-zfFZQyaElwM2Gtv1zqHe6k\/s1700-nu-rw-lo-l85-e365\/DarkWire.png\" alt=\"\" border=\"0\" data-original-height=\"446\" data-original-width=\"1024\"\/><\/a><\/div>\n<p>Also supporting these operations is a set of custom tools &#8211;<\/p>\n<ul>\n<li><strong>CopperLoader<\/strong>, a reflective loader typically deployed through DLL sideloading and is used to deliver additional tools, including CopperDoor, CopperDNS, CopperProxy, and CopperLsass<\/li>\n<li><strong>CopperDoor<\/strong>, a memory-resident modular backdoor<\/li>\n<li><strong>CopperDNS<\/strong>, a CopperDoor variant that communicates through DNS tunneling using MX queries<\/li>\n<li><strong>CopperProxy<\/strong>, a SOCKS5 proxy<\/li>\n<li><strong>PyProxy<\/strong>, a lightweight UDP relay written in Python<\/li>\n<li><strong>CopperLsass<\/strong>, a dedicated module for dumping the <a href=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/10\/05\/detecting-and-preventing-lsass-credential-dumping-attacks\/\" target=\"_blank\">LSASS<\/a> process for credential harvesting<\/li>\n<\/ul>\n<p>\u00abThe operation heavily relies on DLL sideloading as a primary execution technique, often abusing executables that are not widely observed among other threat actors in the wild,\u00bb Check Point said. \u00abTo minimize their footprint, the operators deliberately avoided creating new directories on disk, instead placing their tools within existing system paths.\u00bb<\/p>\n<p>\u00abCopperDoor infrastructure demonstrated a higher level of operational security. Most IP addresses were located in Latin America, often within the same country as the victim organization. This proximity likely helps the malicious traffic blend in with legitimate network activity and reduces the chances of detection.\u00bb<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>Three distinct threat activity clusters with shared infrastructure and malware code similarities have been observed targeting telecommunications providers, government organizations, military entities, research institutions, and critical infrastructure across Latin America,&hellip;<\/p>\n","protected":false},"author":1,"featured_media":4101,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[693,2369,4115,691,312,42,4114],"class_list":["post-4100","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-campaigns","tag-chinanexus","tag-ecosystem","tag-espionage","tag-linked","tag-malware","tag-sparrow"],"_links":{"self":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/4100","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=4100"}],"version-history":[{"count":0,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/4100\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/media\/4101"}],"wp:attachment":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=4100"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=4100"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=4100"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}