Check Point reports three China-nexus campaigns linked via Sparrow malware

What happened

According to The Hacker News, Check Point Research reports three activity clusters with shared infrastructure and malware code similarities, which it tracks as SilentDelivery, OceanGate and DarkWire. The outlet says the clusters were observed over the past year targeting telecommunications providers, government organizations, military entities, research institutions and critical infrastructure across Latin America, Asia and Europe The Hacker News. The article says the clusters, first assumed to be independent, are linked through a malware ecosystem called Sparrow. These are Check Point’s assessments as relayed by one outlet. The sources contain no independent verification and no victim confirmation The Hacker News.

The article says the entity behind the Sparrow framework has been codenamed CopperDragon and is assessed to be a “digital quartermaster” developing tools for China-nexus actors, including FamousSparrow, Earth Estries, Tropic Trooper, UAT-9244 and UAT-8302. The same article says FamousSparrow is assessed to share some overlap with Salt Typhoon, but the nature of that relationship remains unclear The Hacker News.

What Check Point reports about each cluster, per The Hacker News:

• SilentDelivery (from early 2026): selective watering hole attacks aimed at Europe and Asia. Injected JavaScript shows a Chrome SSL certificate warning that tells visitors to install a “Certificate Fix” utility. The trojanized MSI installer delivers a backdoor called SquadC (aka SquawkDoor) or a SparrowDoor variant. The compromised sites were reportedly government, shipping, IT and research sites in the Czech Republic, Germany, France, Taiwan, Nepal, Hong Kong and Indonesia. The article also says Positive Technologies reported in August 2026 indications of targeting in Egypt and the Philippines. SquadC is reportedly also spread by phishing emails to Indonesian organizations, using an LNK file disguised as a PDF that abuses ftp.exe and DLL sideloading.
• OceanGate (2025-2026): mainly Asian organizations. Check Point says initial access came through internet-facing Linux servers, followed by credential harvesting and movement into Windows over RDP, where the actor tried different passwords until an administrator account worked. Tools named in the report include the Linux backdoors AnnobinDoor and SparrowShell, and the Windows tools CopperAdu, CopperList, CopperLogger and CopperLsa. Check Point also describes kernel-level components using WinDivert drivers that let SparrowDoor act as a passive backdoor behind an existing service port such as 443.
• DarkWire (mid 2025): telecommunications providers and government organizations in Latin America. Check Point reports the backdoors CopperDoor (aka SparroWocky) and CopperDNS, delivered mainly through DLL sideloading, with tools placed in existing system paths rather than new directories.

The Hacker News

Separately, the article notes that SparrowShell shares code and infrastructure similarities with Mélofée, a malware first described by ExaTrack in March 2023. It says this has raised the possibility that CopperDragon is also behind Mélofée. The article does not say who raised that possibility, so treat it as an open question rather than a finding The Hacker News.

Not confirmed in the sources: the names of any victims, the number of affected organizations, what data was taken, and the exact relationship between CopperDragon and the named actors.

Am I affected?

The article does not list indicators of compromise, so exposure cannot be confirmed from it. It names these target sectors and regions:

• Sectors: telecommunications, government, military, research, shipping, IT and critical infrastructure.
• Regions: Latin America, Asia and Europe, with the countries listed above for SilentDelivery.

It reports no CVE and no patch. The initial access methods it names are compromised internet-facing infrastructure and watering hole websites The Hacker News. Whether any specific product or version was exploited is not confirmed.

What to do now

1. Read Check Point Research’s technical report, which The Hacker News says was published on the day of its article, for hashes, domains and IP addresses. The article itself does not list them The Hacker News.
2. Search endpoint and proxy logs for users who installed a “Certificate Fix” utility after a browser certificate warning, and for MSI installers with that purpose (SilentDelivery pattern, as reported).
3. Look for a Windows Registry Run key that imitates a Windows update assistant, which the article says SquadC uses for persistence.
4. Review execution of ftp.exe launched from shortcut files disguised as PDFs, and unexpected DLL sideloading by legitimate executables, which the article attributes to SilentDelivery and DarkWire.
5. Check internet-facing Linux servers and the Windows systems reachable from them for repeated failed RDP logins that end in a successful administrator login, as described for OceanGate.
6. Treat this as a single-outlet report of vendor research. Revisit this advisory when further sources or the full Check Point report confirm details.

Update, 11 November 2026

• GBHackers, summarising research it attributes mainly to Check Point, lists hunting leads the first report did not: CertFixer.msi (SquadC installer) file hashes, the domain amelicen[.]com, unexpected LSA security packages, renamed SoftEther binaries and WinDivert drivers. It defangs network indicators and advises re-fanging them only in a controlled threat intelligence platform or SIEM.
• On OceanGate, GBHackers says operators deploy the Go-based AnnobinDoor and use trojanized SSH binaries to harvest credentials before moving laterally.
• On DarkWire, GBHackers reports at least three major regional telecom providers plus foreign affairs and justice agencies as targets. It names CopperLoader, a DLL-sideloaded reflective loader, and says CopperDNS tunnels over DNS MX queries and CopperDoor uses call-stack spoofing to evade EDR tools.
• On attribution, GBHackers says Cisco Talos assessed with high confidence that UAT-9244 overlaps with FamousSparrow and Tropic Trooper. It also says Check Point assesses CopperDragon helps maintain and supply Melofee variants, a Linux implant that ExaTrack linked in 2023 to Winnti-associated Chinese state-sponsored actors. The article cites ESET research saying about 90% of one implant’s targets are in Latin America.
• GBHackers recommends patching internet-facing Linux and Windows services quickly and building detections from shared behaviours rather than one cluster’s artifacts. This is still one outlet relaying vendor research, and the underlying Check Point report was not reviewed.

Sources

• The Hacker News: Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem