CopperDragon Malware Supplier May Arm Chinese Hackers Who Breached Telecoms ...

Five Chinese hacking groups may be drawing on one malware supplier, and Check Point Research said Tuesday that the overlap means the same backdoor in two break-ins no longer proves the same attacker. The firm's report ties three espionage campaigns against telecoms, governments, research institutions and critical infrastructure in 21 countries across Latin America, Asia and Europe to a cross-platform toolkit called Sparrow and to an entity it tracks as CopperDragon.

Security teams that sort alerts by group name now face a different picture. Each of the three clusters used its own backdoors, post-exploitation tools and entry methods, yet shared infrastructure features and code similarities tie them together. That cuts both ways for defenders: one Sparrow fingerprint may expose an operator nobody expected, but a blocklist built around a single group's name may miss a sibling operator running the same code. Check Point published indicators of compromise for all three clusters, so teams can check their own networks now.

Check Point is careful what it can prove. It calls CopperDragon a possible developer and supplier, a "digital quartermaster," rather than a confirmed group, and it says shared malware or servers do not necessarily mean two intrusions an operator. The report does not claim one team ran all three campaigns, and it does not say who runs CopperDragon. The report names no U.S. victims, though ESET separately found FamousSparrow inside a U.S. financial-sector trade group in 2024.

Check Point Tracks One Possible Supplier Behind Three Campaigns in 21 Countries

The 21-country count appears in Check Point's blog summary rather than the technical report, which describes several dozen high-profile organizations and lists seven victim countries for the SilentDelivery cluster alone. Check Point names FamousSparrow, Earth Estries, Tropic Trooper, UAT-9244 and UAT-8302 among the operators the supplier may support, The Hacker News reported . Cisco Talos reached an overlapping conclusion in March, assessing with high confidence that UAT-9244 closely overlaps with FamousSparrow and Tropic Trooper in tooling, tactics and victims.

The supplier idea is not new. FireEye researcher Ned Moran proposed a "digital quartermaster" in November 2013 after finding 11 Chinese campaigns that shared tools, code and signing certificates. ESET argued in 2025 that FamousSparrow's loose links to other groups fit a shared third party better than a merger of the groups. What Check Point adds is a name, a technical lineage and three newly documented tools: SquadC, AnnobinDoor and SparrowShell .

Check Point also assesses that CopperDragon helps maintain and supply variants of Mélofée, a Linux backdoor that French firm ExaTrack described in March 2023 . SparrowShell shares a modified open-source rootkit , loading code and certificate habits with it.

Why Matching Backdoors No Longer Prove One Attacker

The report raises a possible link to Salt Typhoon, the group tied to a breach of U.S. telecoms that came to light in September 2024, but Check Point says the relationship remains unclear . Talos likewise could not verify a solid connection between UAT-9244 and Salt Typhoon, even though both target telecom providers. ESET tracks FamousSparrow separately from Salt Typhoon and says their loose links fit a shared third party better than a merger.

Microsoft reportedly told The Wall Street Journal that Salt Typhoon, FamousSparrow and GhostEmperor are the same group, but ESET disputed that claim in March 2025, saying it sees GhostEmperor and FamousSparrow as two distinct groups. If one supplier hands the same tools to several operators, tool overlap alone cannot settle that dispute. That reading is this article's analysis rather than a Check Point finding, but it follows from the report's own caveat.

Attribution drives real consequences. The Treasury Department sanctioned Sichuan Juxinhe , a firm it tied to Salt Typhoon, in January 2025, and the FBI offered a $10 million reward for information on people associated with the group in April 2025. A supplier whose code appears across several groups makes it harder to say which firm or unit stood behind a given intrusion. Check Point does not say whether CopperDragon is a company, a state unit or an individual developer. China's 2017 National Intelligence Law requires Chinese organizations and citizens to support state intelligence work, though scholars dispute how far that duty reaches.

SilentDelivery Lures Visitors With Fake Chrome Certificate Warnings

SilentDelivery, tracked since early 2026 , compromised legitimate websites in the government, shipping, and IT and research sectors. Heavily obfuscated JavaScript, built with the public jsjiami service, replaced page content with a fake Chrome certificate error written in the site's language and urged visitors to install a "Certificate Fix" utility. The script first checked for Windows and, in some cases, whether the domain matched the intended target.

The utility was a trojanized installer that delivered SquadC or a SparrowDoor variant. SquadC is a C/C++ Windows backdoor that loads in memory through a three-stage loader, runs only when a browser is open, and persists through a Windows registry entry disguised as an update assistant. Three storage buckets on Amazon S3 that Check Point believes the actor compromised hosted the -stage payloads.

Check Point's telemetry shows victims in the Czech Republic, Germany, France, Taiwan, Nepal, Hong Kong and Indonesia. Positive Technologies, a Moscow-based firm, separately reported part of the cluster, and The Hacker News says that reporting points to possible activity in Egypt and the Philippines. A parallel phishing strand aimed at Indonesian organizations used a shortcut file posing as a document that abused the built-in Windows program ftp.exe and then sideloaded SquadC through a malicious library file.

OceanGate Moves From Linux Servers to Windows Administrator Accounts

OceanGate, active across 2025 and 2026 and aimed mainly at government and critical-infrastructure organizations in Asia, started with a vulnerable internet-facing Linux server. On Linux the operators ran AnnobinDoor, a Go-language backdoor that offers a remote shell, file management, SOCKS proxying, SSH tunneling and port forwarding, alongside SparrowShell, a modular backdoor whose design, command-and-control servers and encryption keys match the Windows SparrowDoor. They also swapped in trojanized OpenSSH programs to capture administrator credentials for lateral movement.

On Windows, the operators brute-forced remote desktop logins until an administrator account fell. They then used a toolkit with distinct jobs: CopperAdu to create a hidden administrator account, CopperList for reconnaissance and file inventories, CopperLogger for keystroke and clipboard capture, and CopperLsa, a malicious security package inside the Windows credential process that harvests NTLM and Kerberos credentials.

DarkWire Tunnels Telecom Intrusions Through DNS MX Queries

DarkWire, observed from mid-2025, compromised at least three major regional telecom providers plus foreign-affairs and justice entities, initially in Latin America, and Check Point says recent intrusions suggest expansion beyond the region. Its flagship implant, CopperDoor, which ESET calls SparroWocky, runs from memory and uses call stack spoofing to evade endpoint detection. CopperDNS, a variant, tunnels command traffic through DNS MX record queries, a protocol many networks do not inspect closely.

ESET's separate report says SparroWocky has been deployed since at least August 2025 against government entities in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico and Venezuela, and that 90% of the group's targets in ESET telemetry from mid-2025 into 2026 sat in the region. ESET believes the focus likely reflects China's reaction to recent U.S. initiatives in Latin America.

The operators were careful. They sideloaded malicious libraries through five specific program pairs , staged files in folders that already exist on Windows rather than creating new ones, and rented servers mostly in the victims' own countries so traffic looked local. Their toolkit included CopperLoader, a reflective loader; CopperProxy, a SOCKS5 relay that handles up to 300 simultaneous clients; PyProxy, a Python UDP relay; and CopperLsass, which dumps credentials from the Windows LSASS process. Check Point is explicit that DarkWire's tie to the rest rests on infrastructure overlap and timing, with no direct code similarity beyond general design patterns.

How Do Passive Backdoors Hide Behind Port 443?

An ordinary backdoor phones to its operator. A passive backdoor stays silent and waits to be called, which leaves no outbound connection for defenders to spot. Check Point found that some Windows SparrowDoor versions embed WinDivert packet-diversion drivers . The backdoor watches for traffic from one source address, redirects it from a legitimate port such as 443 to a private high-numbered port, rewrites the replies so they appear to come from the real service, and treats packets carrying a special marker value as commands. All other traffic passes through to the genuine service.

On Linux, SparrowShell can load an encrypted kernel module, a modified version of the open-source Reptile rootkit, that hides files, processes and network activity. Because a rootkit runs with the operating system's own privileges, tools on the infected machine cannot be trusted to report on it, so detection leans on network telemetry and memory forensics.

The same engineering that makes Sparrow easy to also leaves fingerprints. Windows and Linux versions reuse encryption keys and command servers , and several clusters reused self-signed TLS certificates, some kept in service years after they expired. Check Point used those habits to connect campaigns that otherwise looked unrelated. For a supplier, one codebase serves many customers cheaply. For defenders, the shared design means one well-built detection can cover several operators at once.

Check Point Published Indicators of Compromise for All Three Clusters

Check Point's report lists indicators for each cluster: ten file hashes plus domains and seven IP addresses for SilentDelivery, seventeen hashes plus domains and a long IP list for OceanGate, and two dozen hashes plus domains and IP addresses for DarkWire. The report itself contains no dedicated defender section, but Check Point's blog summarizes the guidance : inventory and patch internet-facing systems, scrutinize unexpected "fix" utilities, watch for malicious library loading, credential dumping, keylogging and persistence, restrict remote desktop, file-sharing and SSH access to systems that need it, and monitor DNS and unusual outbound connections. The blog also recommends Check Point's own security products.

The practical lesson is to hunt Sparrow fingerprints rather than group names. A shared backdoor, certificate or server may mean a shared supplier instead of a shared operator, so alerts labeled FamousSparrow, Earth Estries or Salt Typhoon deserve a wider look than the label suggests. Pair indicator checks with behavioral monitoring, patch exposed Linux servers, and treat Check Point's supplier model as a well-evidenced hypothesis, not a proven organizational chart.

Frequently Asked Questions

Is CopperDragon a hacking group?

Not in Check Point's account. CopperDragon is the name for the entity that may have developed and supplied the Sparrow framework, while the operators who break into networks are separate groups. Check Point treats it as something it tracks , not a confirmed organization, and it has not identified who runs it.

Is FamousSparrow the same group as Salt Typhoon?

Sources disagree. Microsoft has reportedly said yes, but ESET tracks FamousSparrow as a separate cluster with loose links, Talos could not verify a solid connection for the related UAT-9244, and Check Point calls the relationship unclear. A shared supplier is one way to explain overlap without a merger.

What is DLL sideloading, and why do these clusters use it?

Windows programs look for supporting library files in their own folder first, so an attacker can place a malicious library beside a legitimate program and have Windows load it. The code then runs inside a trusted process, which makes the activity harder to spot. SilentDelivery's phishing chain and DarkWire both relied on it.

How can a company check whether Sparrow malware is on its network?

Start with the hashes, domains and IP addresses in Check Point's report, then add behavioral checks for hidden administrator accounts, unusual remote desktop and SSH activity, odd DNS traffic and unexpected library loading. Check Point's telemetry placed SilentDelivery victims in seven countries, so organizations in government, shipping, IT, research and telecom sectors have the strongest reason to look.