Three distinct threat activity clusters with shared infrastructure and malware code similarities have been observed targeting telecommunications providers, government organizations, military entities, research institutions, and critical infrastructure across Latin America, Asia, and Europe over the past year.
Check Point Research is tracking the clusters under the names SilentDelivery, OceanGate, and DarkWire. Although initially assumed to be independent sets of attacks, each with its own backdoors and post-exploitation tooling, they have all been linked through a malware ecosystem called Sparrow.
The entity behind the Sparrow framework has been codenamed CopperDragon, and is assessed to be a digital quartermaster developing tools for China-nexus threat actors, including FamousSparrow, Earth Estries, Tropic Trooper, UAT-9244, and UAT-8302.
"Each cluster employed a different toolset and different initial access techniques, including compromising internet-facing infrastructure and highly selective watering hole attacks," Check Point said in a technical report published today. "The compromised websites that were used for watering hole attacks were of government, shipping, and IT and research sectors."
Attacks mounted by FamousSparrow are known for deploying backdoors like SparrowDoor (and its variants Crowdoor and TernDoor), SparroWocky, and HemiGate. It's also assessed to share some degree of overlap with Salt Typhoon. However, the precise nature of the relationship remains unclear.
The cyber espionage ecosystem linked to CopperDragon is driven by three prominent clusters -
- SilentDelivery (Beginning in early 2026), which conducts highly selective watering hole attacks targeting Europe and Asia that distribute a backdoor called SquadC (aka SquawkDoor) through trojanized MSI installers masquerading as certificate repair utilities
- OceanGate (2025-2026), which primarily focuses on Asian organizations with a variant of SparrowDoor after obtaining initial access via internet-facing Linux servers and then moving laterally into Windows environments
- DarkWire (Mid 2025), which targets telecommunications providers and government organizations across Latin America using backdoors called CopperDoor (aka SparroWocky) and CopperDNS
SilentDelivery
The SilentDelivery chain begins with the attacker injecting heavily obfuscated JavaScript into legitimate websites frequented by their intended targets. Visitors to the sites are greeted by a Google Chrome SSL certificate warning that instructs users to install a "Certificate Fix" utility to restore access.
The so-called utility, once deployed, delivers either SquadC or a SparrowDoor variant. All the compromised websites have been found to be related to government, shipping, IT, and research sectors in the Czech Republic, Germany, France, Taiwan, Nepal, Hong Kong, and Indonesia.
According to a report published by Positive Technologies in August 2026, there are indications that the campaign has also targeted entities in Egypt and the Philippines using this method.
"The JavaScript injected into the compromised websites is heavily obfuscated using jsjiami, a publicly available JavaScript obfuscation service," Check Point said. "It first checks whether the user is running Windows and, in some cases, verifies that the website’s domain matches the intended compromised domain."
The script then repeatedly sends status-check requests to a command-and-control (C2) server to fingerprint the user based on IP and geolocation, and ultimately decide whether to continue the attack and serve the fake warning.
 |
| Source: Positive Technologies |
Written in C/C++, SquadC is a Windows backdoor that enables initial foothold over the infected host. It establishes persistence by means of a Windows Registry Run key that masquerades as a Windows update assistant. Further analysis has uncovered that the malware is also distributed via phishing emails targeting Indonesian organizations.
The phishing email comes with a Windows Shortcut (LNK) disguised as a PDF document, which, when opened, abuses the legitimate "ftp.exe" binary to run a batch script that's responsible for displaying an empty file as a decoy, while launching SquadC via DLL sideloading.
OceanGate
The OceanGate operation, on the other hand, has been observed targeting both Windows and Linux environments, deploying previously undocumented tooling to maintain access, move laterally across the network, and exfiltrate sensitive data.
The Linux phase of the attack involves two new backdoors -
- AnnobinDoor, a Go-based backdoor that supports remote access, interactive shell, file management, SOCKS proxying, SSH tunneling, port forwarding, and reverse connections.
- SparrowShell, a modular Linux backdoor that shares overlaps with its Windows counterpart, SparrowDoor
"After harvesting credentials from multiple users and establishing a strong foothold in the Linux environment, the actor moved into the Windows environment," Check Point explained. "The actor attempted to log in to several Windows machines over RDP, trying different passwords until it successfully authenticated with an administrator account."
This step is followed by the deployment of bespoke post-exploitation tools and a variant of SparrowDoor -
- CopperAdu, a post-exploitation tool which configures a compromised Windows machine for remote administrative access
- CopperList, a Windows reconnaissance tool for collecting host information, disk details, and a recursive file inventory, including file paths, sizes, and timestamps
- CopperLogger, a Raw Input-based keylogger to capture keyboard input events, along with monitoring clipboard activity, active window titles, and associated process names and paths
- CopperLsa, a utility that collects passwords, hashes, and authentication tokens from NTLM and Kerberos
What's more, the threat actor has been found incorporating kernel rootkits and kernel-level access capabilities into SparrowDoor and SparrowShell to evade defenses through process hiding and to capture and manipulate network packet capture using WinDivert drivers.
"The actor abused the driver to convert SparrowDoor into a passive backdoor that intercepts and manipulates packets at the kernel level, making its traffic less visible," Check Point said. "This allows the backdoor to listen internally on one port while receiving connections through an externally accessible port, such as 443, that is already used by a legitimate service."
"The backdoor applies a strict filter to intercept connections from a specific source IP address to the legitimate service's port. It manipulates the packet and rewrites the destination port to the backdoor’s internal listening port, typically a high port such as 49628. For response traffic, it rewrites the source port back to the external service port, making the responses appear to originate from the legitimate service."
Interestingly, SparrowShell shares code- and infrastructure-level similarities with a malware called Mélofée that was first described by ExaTrack in March 2023 as based on the open-source Reptile rootkit. This has raised the possibility that CopperDragon is also behind the development and supply of Mélofée.
DarkWire
The third and last cluster of activity centers around Latin America, with a particular focus on telecommunications operators and government entities. These attacks led to the deployment of two newly identified backdoors called CopperDoor and CopperDNS as a possible replacement for SparrowDoor.
Also supporting these operations is a set of custom tools -
- CopperLoader, a reflective loader typically deployed through DLL sideloading and is used to deliver additional tools, including CopperDoor, CopperDNS, CopperProxy, and CopperLsass
- CopperDoor, a memory-resident modular backdoor
- CopperDNS, a CopperDoor variant that communicates through DNS tunneling using MX queries
- CopperProxy, a SOCKS5 proxy
- PyProxy, a lightweight UDP relay written in Python
- CopperLsass, a dedicated module for dumping the LSASS process for credential harvesting
"The operation heavily relies on DLL sideloading as a primary execution technique, often abusing executables that are not widely observed among other threat actors in the wild," Check Point said. "To minimize their footprint, the operators deliberately avoided creating new directories on disk, instead placing their tools within existing system paths."
"CopperDoor infrastructure demonstrated a higher level of operational security. Most IP addresses were located in Latin America, often within the same country as the victim organization. This proximity likely helps the malicious traffic blend in with legitimate network activity and reduces the chances of detection."
