Check Point links three China-nexus clusters via Sparrow malware
Original title: Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem
SilentDelivery, OceanGate, and DarkWire share tooling from CopperDragon, assessed as a quartermaster for several China-linked groups.
Check Point Research says three clusters it calls SilentDelivery, OceanGate, and DarkWire targeted telecoms, government, military, research, and critical infrastructure in Latin America, Asia, and Europe over the past year. The clusters used different access methods and backdoors but share the Sparrow malware ecosystem. Check Point attributes the framework to CopperDragon, which it assesses supplies tools to China-nexus actors including FamousSparrow. Access methods include selective watering holes, phishing, and internet-facing Linux servers.
Unconfirmed: Check Point says overlap with Salt Typhoon exists but the precise relationship is unclear.
- SilentDelivery used fake certificate-repair MSI installers to deliver SquadC or SparrowDoor.
- Compromised watering-hole sites spanned government, shipping, IT, and research sectors.
- SquadC was also sent to Indonesian targets in LNK files that sideload via ftp.exe.
- OceanGate used AnnobinDoor and SparrowShell on Linux, then moved to Windows over RDP.
- DarkWire targeted Latin American telecoms and governments with CopperDoor and CopperDNS.
Impact: Espionage footholds, lateral movement, and data collection
From the original article
6 min read at thehackernews.com
Three distinct threat activity clusters with shared infrastructure and malware code similarities have been observed targeting telecommunications providers, government organizations, military entities, research institutions, and critical infrastructure across Latin America, Asia, and Europe over the past year. Check Point Research is tracking the clusters under the names SilentDelivery,
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.