Sparrow malware ecosystem (CopperDragon): China-nexus espionage via SilentDelivery, OceanGate, DarkWire clusters
Severity: high · Patch status: no-fix-needed · Since 2026-11-10
Check Point Research linked three China-nexus espionage clusters — SilentDelivery, OceanGate, and DarkWire — through a shared malware ecosystem called Sparrow, attributed to a tool developer codenamed CopperDragon. Targets include telecoms, government, military, research and critical infrastructure across Latin America, Asia and Europe. SilentDelivery uses selective watering-hole attacks on government/shipping/IT/research sites (Czech Republic, Germany, France, Taiwan, Nepal, Hong Kong, Indonesia, Egypt, Philippines) serving trojanized MSI 'certificate fix' installers with the SquadC backdoor. OceanGate compromises internet-facing Linux servers with AnnobinDoor and SparrowShell, then pivots to Windows via RDP password guessing, deploying SparrowDoor variants, keyloggers and credential harvesters, plus kernel rootkits using WinDivert drivers to hide traffic. DarkWire targets Latin American telecoms and governments with CopperDoor and CopperDNS. No vendor patch applies; defense relies on detection and hardening.
What to do
- Hunt for Sparrow-family indicators (SquadC, SparrowDoor, AnnobinDoor, SparrowShell, CopperDoor, CopperDNS) and WinDivert driver abuse on Windows and Linux hosts
- Harden and monitor internet-facing Linux servers; review SSH/RDP logs for password-guessing and lateral movement
- Warn users against installing 'certificate fix' utilities from browser SSL warnings; inspect public websites for injected obfuscated JavaScript
- Enforce MFA on remote access, rotate credentials, and audit NTLM/Kerberos token exposure
- Monitor for Registry Run-key persistence masquerading as Windows Update Assistant and DLL sideloading via ftp.exe
Sources
All live incidents on Threat Watch
