CopperDragon tooling linked to China-nexus espionage across three regions
Original title: China-Linked CopperDragon Malware Framework Targets Critical Infrastructure Across Europe, Asia, and Latin America
SilentDelivery, OceanGate and DarkWire hit telecom, government and critical infrastructure with shared backdoors and credential tools.
Check Point research ties three espionage clusters to CopperDragon, a China-nexus tooling supplier it says may support FamousSparrow, Earth Estries, TropicTrooper and UAT-9244. Targets include telecommunications, government, military, research and critical infrastructure in Latin America, Asia and Europe. Campaigns use watering holes, spear-phishing and breached Linux servers, then deploy backdoors such as SquadC, SparrowDoor and CopperDoor.
Unconfirmed: A link to Salt Typhoon is unclear: Talos found no solid connection, and Check Point calls the relationship unclear.
- SilentDelivery uses fake Chrome certificate fixes and an LNK archive that delivers SquadC.
- OceanGate deploys Go-based AnnobinDoor and SparrowShell, then moves to Windows via RDP.
- DarkWire, seen from mid-2025, tunnels with CopperDNS over DNS MX queries.
- Cisco Talos assesses with high confidence that UAT-9244 overlaps FamousSparrow and Tropic Trooper.
- Defenders are told to watch LSA packages, WinDivert, renamed SoftEther binaries and DLL sideloading.
Impact: Long-term espionage access, credential theft and email-capable backdoors
- 1.Patch internet-facing Linux and Windows services quickly.
- 2.Monitor for unexpected LSA security packages, WinDivert drivers and renamed SoftEther binaries.
- 3.Look for DLL sideloading from system paths and shared cluster artifacts.
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | amelicen.com | r, uses call-stack spoofing to evade EDR tools . The domain amelicen[.]com ties DarkWire to earlier SparrowDoor infrastructure. ESET |
| sha256 | 715c206629f59ff5b0134a33362162ce7a40a9b25aa17f0543dc9648d51a67cf | hers. IOCs Malware Name Hash SquadC Installer CertFixer.msi 715c206629f59ff5b0134a33362162ce7a40a9b25aa17f0543dc9648d51a67cf SquadC Installer CertFixer.msi b379d07ba81d4190490d9893b2d6 |
| sha256 | b379d07ba81d4190490d9893b2d6d830ff594e042dce26053ef07794d0403787 | a9b25aa17f0543dc9648d51a67cf SquadC Installer CertFixer.msi b379d07ba81d4190490d9893b2d6d830ff594e042dce26053ef07794d0403787 SquadC Installer CertFixer.msi e5f7bbfc187264336dea5dfebfb5 |
| sha256 | e5f7bbfc187264336dea5dfebfb5a7dd1e7fcdcc9692db55fbe6eb4d28f027bc | 4e042dce26053ef07794d0403787 SquadC Installer CertFixer.msi e5f7bbfc187264336dea5dfebfb5a7dd1e7fcdcc9692db55fbe6eb4d28f027bc Note: IP addresses and domains are intentionally defanged ( |
From the original article
3 min read at gbhackers.com
Research has tied three seemingly unrelated espionage campaigns to a single supplier of Chinese-nexus tooling, which it tracks as CopperDragon. It may act as a “digital quartermaster,” supplying tools to several China-nexus actors, including FamousSparrow, Earth Estries, TropicTrooper and UAT-9244.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.