Sparrow Links Three China-Nexus Espionage Campaigns
Check Point Research linked three espionage campaigns against telecoms, government, military and research targets in Latin America, Asia and Europe to one malware ecosystem, Sparrow, and a tool developer it calls CopperDragon.
⚡ Why it matters
A shared tool supplier serving several spy groups means new exploits and backdoors spread quickly between them, with telecoms and governments as prime targets.
Check Point says the three campaigns first looked independent, each with its own backdoors and tooling, but they share infrastructure and code similarities. CopperDragon is assessed as a digital quartermaster building tools for China-nexus groups such as FamousSparrow, Earth Estries and Tropic Trooper. FamousSparrow partly overlaps with Salt Typhoon, though the exact relationship is unclear.
The three campaigns
- SilentDelivery (since early 2026): selective watering hole attacks in Europe and Asia. Obfuscated JavaScript injected into legitimate sites shows a fake Chrome SSL warning and pushes a "certificate repair" MSI that installs the SquadC backdoor. Compromised sites belonged to government, shipping, IT and research sectors.
- OceanGate (2025-2026): targets Asian organizations with a SparrowDoor variant, starting from internet-facing Linux servers and moving into Windows networks.
- DarkWire (mid-2025): hits Latin American telecoms and government bodies with the CopperDoor and CopperDNS backdoors.
What to do
- Never install a "repair tool" a website offers after a certificate warning; real browser warnings do not ask you to download software.
- Patch internet-facing Linux servers and watch for lateral movement into Windows networks.
- Telecom operators should check Check Point's IoCs.
🔗 Sources
This article is original reporting by the Security World editorial team based on the sources listed above; direct quotes are kept short and marked with quotation marks. Corrections and feedback: info [at] securitywd.net.
Related stories
Operation TorNado: 354 Dark Web Vendors and Buyers Arrested
Europol and the US Justice Department announced 354 arrests of vendors and buyers on dark web markets including Archetyp, Nemesis, Tor2Door, Bohemia and Kingdom, in a 14-country operation called TorNado.
German Law Gives Spy Agencies Hacking and Sabotage Powers
Germany's Bundestag passed a law on Friday letting intelligence agencies hack foreign systems, disrupt adversaries' supply chains and knock offline servers operated by hostile state hacking groups.
ArcticRAT Android Malware Uses AI to Profile Victims
Zimperium reports that ArcticRAT has evolved from an Android crypto stealer into a remote access Trojan (RAT) that takes over devices and uses an AI model to sift stolen messages for financial information.