Check Point links three espionage clusters to Sparrow supplier CopperDragon
November 11: Infosecurity adds several dozen targets, at least three major telecoms, Melofee supply claims, an unclear Salt Typhoon link, and a domain-only DarkWire tie.
Check Point ties SilentDelivery, OceanGate and DarkWire to CopperDragon’s Sparrow tooling against dozens of high-profile targets.
Check Point Research says a year-long investigation linked SilentDelivery, OceanGate and DarkWire through the Sparrow malware framework and tracks the supplier as CopperDragon, a possible quartermaster for China-nexus actors including FamousSparrow, Earth Estries, TropicTrooper and UAT-9244. Targets span telecommunications, government, military, research and critical infrastructure in Latin America, Asia and Europe, including several dozen high-profile organizations. Access included compromised sites, selective watering holes, phishing and internet-facing Linux systems; deployed tools include SquadC, SparrowDoor, AnnobinDoor, SparrowShell, CopperDoor and CopperDNS. Cyber Security News says the fake Chrome certificate chain does not indicate a Chrome vulnerability, and Check Point warns shared malware does not prove one operator. Infosecurity Magazine reports DarkWire’s link rests on a FamousSparrow-related domain rather than direct code overlap.
- SilentDelivery, seen since early 2026, used fake Chrome certificate MSI installers for SquadC or SparrowDoor.
- OceanGate, observed in 2025 and 2026, started on Linux and moved to Windows over RDP.
- DarkWire hit Latin American telecoms, including at least three major providers, plus government bodies.
- CopperDNS carries command traffic through DNS MX queries; DarkWire was seen from mid-2025.
- Cisco Talos assesses with high confidence that UAT-9244 overlaps FamousSparrow and Tropic Trooper.
- Check Point says CopperDragon may also supply Melofee variants; Salt Typhoon ties remain unclear.
What each outlet adds
beyond the shared facts- Check Point ResearchNames three clusters, CopperDragon, and a watering-hole XSS path.
- The Hacker NewsSquadC also delivered to Indonesian targets via LNK files sideloading ftp.exe.
- GBHackersCites Cisco Talos on UAT-9244 overlap with FamousSparrow and Tropic Trooper.
- Cyber Security NewsSays the fake certificate chain is not a Chrome vulnerability.
- Infosecurity MagazineSeveral dozen victims, three major telecoms, Melofee, and domain-only DarkWire link.
Coverage
oldest first · one row per article · UTC- · 1d ago
Check Point ResearchFirst report
CopperDragon Sparrow framework tied to espionage on three continents
SilentDelivery, OceanGate and DarkWire share Sparrow tooling against telecom, government, military and research targets.
- · 1d ago
The Hacker News
Check Point links three China-nexus clusters via Sparrow malware
SilentDelivery, OceanGate, and DarkWire share tooling from CopperDragon, assessed as a quartermaster for several China-linked groups.
- · 15h ago
GBHackers
CopperDragon tooling linked to China-nexus espionage across three regions
SilentDelivery, OceanGate and DarkWire hit telecom, government and critical infrastructure with shared backdoors and credential tools.
- · 11h ago
Cyber Security News
SilentDelivery uses fake Chrome warnings to install Sparrow backdoor
Check Point says compromised sites push a Windows installer; the chain does not show a Chrome vulnerability.
- · 4h ago
Infosecurity Magazine
Check Point links three intrusion clusters to suspected supplier CopperDragon
SilentDelivery, OceanGate, and DarkWire share Sparrow code or infrastructure across Latin America, Asia, and Europe.