Not All That Glitters Is Gold: Tracking CopperDragon’s Sparrow Framework Around the Globe

The report

Key Points Introduction Over the past year, Check Point Research investigated a series of intrusion campaigns targeting several dozens of high-profile organizations across Latin America, Asia, and Europe. These campaigns initially appeared to be independent operations, each using different backdoors, post-exploitation tools and operational pace. However, we identified numerous connections between the tools and their […]

Read the full analysis: Not All That Glitters Is Gold: Tracking CopperDragon’s Sparrow Framework Around the Globe (Check Point Research).

What the report says

Check Point Research reports a year-long investigation into three clusters, SilentDelivery, OceanGate and DarkWire, that target telecoms, government, military, research and critical infrastructure organizations across Latin America, Asia and Europe. The authors link them through shared infrastructure and code similarities in the Sparrow malware framework and track the entity behind it as CopperDragon, a possible “digital quartermaster” supporting China-nexus actors. The excerpt covers mainly the SilentDelivery watering-hole campaign and its SquadC backdoor.

• The report says each cluster used a different toolset and different initial access techniques, including compromising internet-facing infrastructure and highly selective watering-hole attacks. The authors found previously undocumented tools, Windows and Linux Sparrow variants, passive backdoor capabilities, and a connection to the Melofee backdoor.
• SilentDelivery began in early 2026 and focuses on Europe and Asia. Compromised government, shipping, and IT and research websites show a fake Chrome SSL certificate warning that tells users to install a “Certificate Fix” utility. The utility delivers either the new SquadC backdoor or a SparrowDoor variant. In one case a site was exploited using XSS on an unsensitized input field.
• Check Point telemetry shows SilentDelivery mainly targeting organizations in the Czech Republic, Germany, France, Taiwan, Nepal, Hong Kong and Indonesia. Three S3 buckets believed compromised by the actor hosted the next-stage MSI backdoor. Positive Technologies reported part of this cluster as well.
• SquadC is a Windows backdoor in C/C++ loaded in memory by a three-stage loader. It can check for sandbox and VM artifacts and run only if a browser (chrome.exe, msedge.exe, edge.exe, firefox.exe, brave.exe) is running. It persists through a registry Run key named WindowsUpdateAssist. Its commands cover directory listing, file delete and write, arbitrary command execution, systeminfo, and screenshots.
• SquadC was also spread by spear phishing. An archive named Strategi_AS_Referensi_April2026.rar, uploaded to VirusTotal from Indonesia, contained an LNK abusing the ftp.exe LOLBin, a batch script, a CAB with the SquadC loader, and an empty decoy file. It used the same C2 IP as the watering-hole chain.
• OceanGate mainly targets Asian organizations, using a SparrowDoor variant after compromising internet-facing Linux systems and moving laterally into Windows. DarkWire targets telecoms and government organizations in Latin America using CopperDoor and CopperDNS as its main backdoors.

Named in the report: CopperDragon, Sparrow, SilentDelivery, OceanGate, DarkWire, SquadC, SparrowDoor, CopperDoor.

This digest was written from the report text itself by a language model and checked by script: every number and CVE id in it appears in the report. The report is the source; read it for the full detail.

Indicators

The report is tracked for context; no indicator from it met the bar for blocking (for example, it only names shared hosting).

How this is tracked

EncryptLayer intelligence, A.R.P. Syndicate’s open threat feed, reviews each indicator against the published report before adding it (#40). This page is generated from that record and the report itself; the indicators are never rewritten.