CopperDragon Sparrow framework tied to espionage on three continents
Original title: Not All That Glitters Is Gold: Tracking CopperDragon’s Sparrow Framework Around the Globe
SilentDelivery, OceanGate and DarkWire share Sparrow tooling against telecom, government, military and research targets.
Check Point Research says a year-long investigation linked three intrusion clusters—SilentDelivery, OceanGate and DarkWire—through the Sparrow malware framework. It tracks the supplier as CopperDragon, a possible quartermaster for China-nexus actors including FamousSparrow, Earth Estries, TropicTrooper and UAT-9244. Targets include telecommunications, government, military, research and critical infrastructure in Latin America, Asia and Europe. Access included compromised internet-facing systems and selective watering-hole attacks.
Unconfirmed: CopperDragon is Check Point’s name for a possible supplier, and the FamousSparrow link to Salt Typhoon remains unclear.
- SilentDelivery used fake Chrome certificate pages and Trojanized MSI installers to deploy SquadC or SparrowDoor.
- Confirmed watering-hole sites belonged to government, shipping, and IT and research sectors.
- One compromised site was reached through XSS on an unsensitized input field.
- OceanGate started on internet-facing Linux systems, then moved laterally into Windows.
- DarkWire used CopperDoor and CopperDNS against Latin American telecom and government organizations.
Impact: Espionage footholds on telecom, government, military and research systems
- 1.Treat fake Chrome certificate-repair MSI installers as a possible Sparrow delivery path.
- 2.Review internet-facing Linux hosts used as initial access into Windows networks.
- ATT&CK
- T1189 Drive-by CompromiseT1190 Exploit Public-Facing ApplicationT1036 MasqueradingT1204.002 Malicious File
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| sha1 | 760be920fad07881b8ce9d94e074a35b4f806717 | 11:13:39 Not After: 2024-04-27 11:13:39 Fingerprint SHA-1: 760be920fad07881b8ce9d94e074a35b4f806717 TLS certificate reused across SilentDelivery and OceanGate |
From the original article
12 min read at research.checkpoint.com
Key Points Introduction Over the past year, Check Point Research investigated a series of intrusion campaigns targeting several dozens of high-profile organizations across Latin America, Asia, and Europe. These campaigns initially appeared to be independent operations, each using different backdoors, post-exploitation tools and operational pace.
research.checkpoint.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.