Not All That Glitters Is Gold: Tracking CopperDragon’s Sparrow Framework Around the Globe

During a year-long investigation, Check Point Research identified three distinct operational clusters spanning Latin America, Asia, and Europe targeting telecommunications providers, government organizations, military entities, research institutions, and critical infrastructure.

The clusters , SilentDelivery, OceanGate and DarkWire , are linked through shared infrastructure features and malware code similarities within the Sparrow malware framework.

We track the entity behind the Sparrow framework as CopperDragon , a potential digital quartermaster supporting China-nexus threat actors, including FamousSparrow , Earth Estries , TropicTrooper , UAT-9244 , and others.

Each cluster employed a different toolset and different initial access techniques, including compromising internet-facing infrastructure and highly selective watering-hole attacks. The compromised websites that were used for watering hole attacks were of government, shipping, and IT and research sectors.

Our research uncovered several previously undocumented tools and new details the Sparrow framework, including Windows and Linux variants, passive backdoor capabilities , and a connection to the Melofee backdoor.

Over the past year, Check Point Research investigated a series of intrusion campaigns targeting several dozens of high-profile organizations across Latin America, Asia, and Europe. These campaigns initially appeared to be independent operations, each using different backdoors, post-exploitation tools and operational pace.

However, we identified numerous connections between the tools and their infrastructure which linked them to the same Sparrow malware ecosystem. We track the entity behind these campaigns as CopperDragon , which may serve as a digital quartermaster supporting a number of China-nexus threat actors that use the Sparrow cross-platform malware framework for Linux and Windows.

What is CopperDragon?

FamousSparrow is a threat actor that was first identified in 2021, whose main backdoor is SparrowDoor . Since then, multiple vendors have reported on related activity and malware variants, including CrowDoor , HemiGate , and TernDoor .

Over time, it became apparent that this other activity was not necessarily carried out by the original FamousSparrow group. Instead, reporting pointed to several distinct actors using a shared toolset, potentially supplied by the same entity. These actors include FamousSparrow , Earth Estries , TropicTrooper , UAT-9244 , and others. FamousSparrow was previously also linked to Salt Typhoon, but the relationship details remain unclear. Based on the apparent tool-sharing, we began tracking the entity behind the Sparrow framework as CopperDragon , its possible developer and supplier.

In this report, we examine three distinct activity clusters targeting major telecommunications providers , government organizations , and military entities . Together, these operations provide a broader view of the connected and evolving espionage ecosystem linked to CopperDragon :

SilentDelivery uses highly selective watering-hole attacks that distribute the SquadC backdoor through Trojanized MSI installers masquerading as certificate repair utilities. This cluster focuses on Europe and Asia regions.

OceanGate focuses primarily on Asian organizations and uses a variant of SparrowDoor . The actor first compromised internet-facing Linux systems before moving laterally into Windows environments, using a broad set of post-exploitation tools for both operating systems.

DarkWire targets telecommunications providers and government organizations across Latin America, using CopperDoor and CopperDNS as its main backdoors.

SilentDelivery: Selective Watering-Hole Attacks

Beginning in early 2026, we started tracking new activity related to CopperDragon that introduces a unique initial access methodology, using watering-hole attacks that target high-profile organizations mainly in Europe and Asia. We track this activity as the SilentDelivery operation. While we were finalizing this report, part of this cluster was also reported by Positive Technologies.

The attackers first compromised legitimate websites frequently visited by their intended targets. When a victim visited one of these websites, a heavily obfuscated JavaScript payload injected into the page completely replaced the legitimate content with a Google Chrome SSL certificate warning customized to the website’s language. The fake warning blocked access to the website and instructed the user to install a “Certificate Fix” utility. This utility deployed either a previously undocumented backdoor called SquadC or, in some cases, a variant of SparrowDoor .

All the compromised websites we confirmed were related to the government, shipping, and IT and research sectors. In one case, the website was exploited using an XSS attack on an unsensitized input field. Based on Check Point telemetry, the operations primarily targeted organizations in countries such as the Czech Republic, Germany, France, Taiwan, Nepal, Hong Kong and Indonesia.

Across the analyzed websites, we also identified three S3 buckets that we believe were compromised by the threat actor. These buckets hosted the -stage backdoor, which was downloaded when the user clicked the “Install certificate” button.

The JavaScript injected into the compromised websites is heavily obfuscated using jsjiami , a publicly available JavaScript obfuscation service. It first checks whether the user is running Windows and, in some cases, verifies that the website’s domain matches the intended compromised domain.

The script then starts a loop that repeatedly sends status-check requests to the C2 (command and control) server at /image-check?t= . These requests are used to fingerprint the user based on IP and geolocation and determine whether to continue the attack and hijack the webpage. They also enable the threat actor to control the attack and stop displaying the fake certificate error after a successful compromise, thus reducing the likelihood of raising the user’s suspicions. If the server returns HTTP 200, the webpage is left unchanged and the user can access the website normally. If the server does not respond, the script hijacks the webpage and displays the fake certificate error.

When the user clicks “Install certificate”, the script sends a POST request to the C2 server at /report-url . This request reports the click and includes the compromised website’s URL in its JSON body. At the same time, the script initiates the download of an MSI package containing the -stage backdoor from an attacker-controlled S3 bucket.

After the user executes the backdoor, it sends a request to the C2 server at /register-ip , indicating a successful compromise. The fake certificate error will not appear the time the user visits the compromised website.

SquadC is a Windows backdoor written in C/C++ that provides operators with basic remote control over a compromised host. The backdoor is loaded in memory using a separate loader component that decrypts and loads it through a three-stage process. The name SquadC is derived from an internal reference left by the author in the sample:

Depending on its configuration, the backdoor supports several flags, including one that enables checks to avoid execution in sandbox environments. These checks look for VM artifacts in the file system and Windows registry, as well as blacklisted MAC addresses and specific screen resolutions and disk sizes.

As an additional measure to evade sandboxes and automated analysis, the backdoor can be configured to run only if a browser is currently running on the host. As the backdoor is downloaded through a browser during the infection, it’s expected that a browser remains open. The check is done by enumerating running process names and comparing them against a fixed list of browsers:

To survive host reboots, the backdoor achieves persistence by manipulating the registry Run key under a key WindowsUpdateAssist .

The backdoor supports a small set of commands for command execution and file system management and serves mainly as an initial foothold in the compromised host.

These commands are supported by SquadC:

SquadC in phishing attacks

While hunting for related files, we identified an additional way to distribute SquadC through spear phishing. We found a compressed archive named Strategi_AS_Referensi_April2026.rar , uploaded to VirusTotal from Indonesia which aligns with Indonesian organizations observed in watering-hole activity. The backdoor was configured to communicate with the same IP address used in the watering-hole infection chain, suggesting that both activities were linked to the same threat actor.

The archive contains four files:

Strategi_AS_Referensi_April2026.docx.lnk – An LNK file abusing the ftp.exe LOLBin for command execution.

_rels/info.dll – A batch script executed using ftp.exe :

_rels/.rels.log – A cab file containing the SquadC loader components:

_rels/557.pdf – An empty file.

When the LNK file is executed, it runs a series of CMD commands to extract and execute the SquadC backdoor. It also opens a decoy document, which in this case is an empty file.

SilentDelivery Infrastructure

The SilentDelivery operation was attributed to CopperDragon based on two primary observations:

In some cases, the final payload was a variant of SparrowDoor . Even in cases involving SquadC , the DLL used to load the backdoor was previously used in the FamousSparrow toolset.

The C2 infrastructure of SquadC shares several characteristics with infrastructure associated with FamousSparrow , including server layout, exposed services and ports, HTTP response banners, and reused TLS certificates.

TLS certificate reused across SilentDelivery and OceanGate C2 infrastructure.

TLS certificate reused across SilentDelivery and OceanGate C2 infrastructure.

OceanGate: From Linux Initial Access to Domain Administrator

The OceanGate operation was observed during 2025-2026 primarily targeting government organizations and critical infrastructure in Asia. Some activity was also seen in other regions. The operation followed a more common intrusion pattern, with tooling and operational TTPs (Tactics, Techniques, and Procedures) consistent with those previously reported by multiple vendors and tracked as FamousSparrow .

In this attack, the threat actor operated across both Linux and Windows environments, deploying several previously unreported tools to maintain access and move across the compromised network. The operation involved extensive credential theft, lateral movement, data staging, and exfiltration of sensitive operational information. The Linux activity was particularly interesting, given the limited reporting on how the actor operates in these environments and the tools it uses.

The intrusion began with the exploitation of a vulnerable internet-facing Linux server, followed by the deployment of two new backdoors: AnnobinDoor and SparrowShell .

The first backdoor deployed after initial access was AnnobinDoor , a statically linked, Go-based backdoor packed with UPX and internally named annobinagent . By default, it uses WebSocket but also supports HTTP and raw TCP. Its requests include browser-like headers and standard WebSocket upgrade fields, which helps the traffic resemble legitimate application communications.

The backdoor provides a broad range of remote access and pivoting capabilities, including an interactive shell, file management, SOCKS proxying, SSH tunneling, port forwarding, and reverse connections.

Together, these features allow the infected Linux host to function as both a remote shell and an internal network pivot.

Later in the attack, the actor also deployed another backdoor we named SparrowShell . SparrowShell is a modular Linux backdoor that shares significant design and code similarities with the Windows backdoor SparrowDoor . The two belong to the same cross-platform malware family, with versions developed for Linux and Windows. They the same C2 infrastructure and RC4 decryption keys, as well as similar command-line arguments and comparable plugin-based architectures.

These commands are supported by SparrowShell:

A few days later, the threat actor replaced the legitimate SSH client and SSHD components on the server with Trojanized versions designed to log credentials during administrative activity. This allowed the actor to harvest credentials from multiple users and move to other Linux hosts on the network, where the same technique was used again.

Besides custom tools and scripts, the threat actor also used popular publicly available tools, including FRPC and Chisel , which provided additional channels for remote access and internal pivoting. The actor also used ASimplePortScanner , an open-source Python scanner, to discover additional hosts in the network.

After harvesting credentials from multiple users and establishing a strong foothold in the Linux environment, the actor moved into the Windows environment.

The actor attempted to log in to several Windows machines over RDP, trying different passwords until it successfully authenticated with an administrator account. It then deployed a set of custom post exploitation tools before deploying the final windows backdoor a variant of SparrowDoor .

CopperAdu is a post-exploitation tool that configures a compromised Windows host for remote administrative access, preparing it for further attacker activity.

It creates a local account with hardcoded credentials, disables password expiration, and adds the account to the local Administrators group. It also modifies the registry to hide the account from the standard Windows logon interface.

The tool sets LocalAccountTokenFilterPolicy to 1 , allowing remote connections using local administrator accounts to retain full administrative privileges and facilitating lateral movement.

Finally, CopperAdu enables the LanmanServer and LanmanWorkstation services and configures an inbound Windows Firewall rule to allow SMB traffic on TCP port 445 .

The actor then deployed CopperList, a Windows reconnaissance tool that collects host information, disk details, and a recursive file inventory, including file paths, sizes, and timestamps. It scans fixed drives while excluding common system and application directories, focusing on user data and potentially sensitive files. The collected information is compressed using LZNT1 and staged for exfiltration by other attacker-deployed components.

Beyond keystroke logging, the malware also collects contextual information, including:

Associated process names and paths

In addition, the malware monitors clipboard activity involving copying and pasting, and stores it alongside the keystroke data.

For credential theft on Windows systems, the actor deployed CopperLsa , a tool that collects credentials directly through the Windows authentication flow. Its loader decrypts two embedded DLLs: one installs a custom LSA security package inside LSASS, while the other collects passwords, hashes, and authentication tokens from several authentication mechanisms, including NTLM and Kerberos. The stolen credentials are saved to a log file at a location chosen by the operator.

Kernel-level capabilities

In some cases, we observed the actor adding kernel rootkits and kernel-level access capabilities to its main backdoors: SparrowDoor for Windows and SparrowShell for Linux.

SparrowShell kernel rootkit

SparrowShell supports integration with an embedded kernel rootkit. When executed with the hide flag, the backdoor locates an appended encrypted blob, decrypts it, and loads it into memory as a kernel module using the init_module system call.

The kernel component is a modified version of the open-source Reptile rootkit and supports capabilities such as hiding files, processes, and network activity. Communication between user space and the rootkit uses a custom ioctl interface with the ID 0x0e0e0e0e .

Passive Sparrow backdoor

Some observed versions of the Windows backdoor SparrowDoor include kernel-level packet interception capabilities, with WinDivert drivers embedded as resources for x86 and x64. WinDivert is a legitimate driver for network packet capture and manipulation, and is commonly used by utilities such as VPNs, firewalls, and tunneling applications.

The actor abused the driver to convert SparrowDoor into a passive backdoor that intercepts and manipulates packets at the kernel level, making its traffic less visible. This allows the backdoor to listen internally on one port while receiving connections through an externally accessible port, such as 443 , that is already used by a legitimate service.

The backdoor applies a strict filter to intercept connections from a specific source IP address to the legitimate service’s port. It manipulates the packet and rewrites the destination port to the backdoor’s internal listening port, typically a high port such as 49628 . For response traffic, it rewrites the source port back to the external service port, making the responses appear to originate from the legitimate service.

Incoming connections are checked for the magic value 0x11223344 . Matching requests are queued for backdoor command processing, while nonmatching traffic is forwarded to the legitimate service at 127.0.0.1: , allowing normal connections to continue functioning.

While analyzing SparrowShell , we identified several similarities with the Melofee backdoor, which was first discovered in 2023. Both use similarly modified versions of the open-source Reptile rootkit and code similarities in how they decrypt, load, and activate the rootkit. They also support the same hide and show command-line arguments for rootkit control. These similarities led some vendors to classify SparrowShell as Melofee.

The connection between Melofee and CopperDragon’s SparrowShell became stronger when we analyzed Melofee samples that also shared infrastructure characteristics, particularly in their self-signed certificates. Both used certificate subject values such as Some-State and O=Internet Widgits Pty Ltd and impersonated public DNS servers in the common name (CN) field. Both also used certificates created years earlier that remained in use long after their expiration.

Based on these findings, including code similarities and infrastructure overlaps, we assess that CopperDragon is also involved in maintaining and supplying Melofee variants.

DarkWire: Compromising Telecommunications Providers

In mid-2025, we identified a new wave of activity, tracked as DarkWire . While initially concentrated in Latin America, more recent intrusions suggest expansion beyond the region. Victimology indicates a clear focus on telecommunications operators and government entities, including at least three major telecom providers in the region, as well as the foreign affairs and justice sectors.

Throughout our investigation, we uncovered multiple custom tools, suggesting the actor maintains a broader proprietary toolkit. The actor deployed two newly identified backdoors, which we named CopperDoor and CopperDNS . These appear to function as the group’s primary implants and may have replaced the SparrowDoor family.

Beyond these backdoors, the actor was observed deploying several additional custom tools, including proxy utilities such as CopperProxy and PyProxy , as well as CopperLsass , a dedicated module used to dump the LSASS process for credential harvesting. Most of the post exploitation tools including the new backdoors were loaded by a unique loader we named CopperLoader.

Alongside these tools, the operators also employed publicly available software, such as SoftEther VPN renamed to names like vmtoolsd.exe and csrss.exe . For lateral movement, they transferred files over SMB and executed remote commands via WMI, using wmiexec .

CopperLoader is a reflective loader typically deployed through DLL sideloading. It consists of position-independent shellcode written into a modified version of the original DLL being hijacked. In some cases, CopperLoader was not the initial sideloaded component, but arrived as a second-stage shellcode payload delivered by another shellcode loader.

CopperLoader loads an encrypted -stage PE module from a .dat file in its directory. These files contain the -stage module in encrypted form. While the exact layout varies across samples, a consistent set of embedded headers provides the information needed to process each payload: module length, RC4 decryption key, and in some cases, the backdoor configuration.

The MZ and PE signatures were removed in the decrypted module, hindering memory scanning and automated extraction.

We observed CopperLoader delivering four unique tools: CopperDoor , CopperDNS , CopperProxy , and CopperLsass .

CopperDoor & CopperDNS

The main backdoor used in the DarkWire operation was CopperDoor , a newly identified advanced modular backdoor that resides entirely in memory. CopperDoor uses some novel techniques such as call stack spoofing and gadget-based execution for EDR evasions. The malware, also known as SparroWocky , was recently analyzed in depth by ESET as part of its research into FamousSparrow activity.

Alongside CopperDoor, we also observed a variant of the backdoor that communicates through DNS tunneling using MX queries , which we named CopperDNS .

CopperProxy & PyProxy

CopperProxy is a SOCKS5 proxy tool. It accepts an IP address and TCP port as command-line arguments, configures a Windows Firewall rule named ss1 for the specified port, and listens for incoming connections, supporting up to 300 concurrent clients. For each connection, it handles SOCKS5 negotiation, connects to the requested destination, and relays traffic in both directions.

PyProxy is a lightweight UDP relay written in Python and packaged as a standalone executable using PyInstaller. It listens on a fixed local UDP port and relays traffic in both directions between local clients and a hardcoded remote IP address and port.

CopperLsass is a DLL module that loads a component named slave.dll into LSASS by registering it as a security package through RPC. Once inside LSASS, slave.dll uses the Windows library comsvcs.dll and a helper DLL, dep.dll to create a full LSASS memory dump, encrypt it using a custom SUB-XOR-ADD algorithm, and delete the original dump. In observed intrusions, the encrypted file was renamed to 1.png before exfiltration to resemble an image file.

Execution and Staging

The operation heavily relies on DLL sideloading as a primary execution technique, often abusing executables that are not widely observed among other threat actors in the wild.

The executables we observed in use include:

To minimize their footprint, the operators deliberately avoided creating new directories on disk, instead placing their tools within existing system paths.

The file paths we observed in use:

DarkWire Infrastructure

CopperDoor infrastructure demonstrated a higher level of operational security. The associated IP addresses were distributed across a variety of autonomous systems. These servers typically exposed port 443, with communications conducted over raw TCP encapsulated in TLS instead of standard HTTPS. In several cases, the TLS certificates deployed on these C2 servers contained Common Name (CN) values that closely mimic domains associated with the targeted victim organizations.

In contrast, infrastructure linked to CopperDNS, which functions as a DNS tunneling C2 channel, consisted primarily of Windows-based hosts. These systems were consistently hosted within AS20473, AS-VULTR, exposed high-numbered ports (most commonly 6532), and reused a distinctive TLS certificate (SHA-256: ee4a8b81fe3864582efc27a77f806990e2602dcc36447ddda4b3a230a473d575 ) across multiple nodes.

An additional pattern we observed across both infrastructures is geographic alignment with target regions. Most IP addresses were located in Latin America, often within the same country as the victim organization. This proximity likely helps the malicious traffic blend in with legitimate network activity and reduces the chances of detection.

We did not identify direct code similarities in DarkWire cluster with other tools in the CopperDragon toolset aside from general design patterns. However, we found an infrastructure link to a report on FamousSparrow activity. The domain amelicen[.]com was reported as a SparrowDoor C2 server, and our telemetry showed that the same domain was also part of the CopperDNS infrastructure.

We also observed VirusTotal submitters uploading files related to both SparrowDoor and DarkWire around the same time, suggesting that these tools may have been used in the same attack. In a recent report, ESET also observed that SparrowDoor was replaced on compromised hosts by CopperDoor (AKA SparroWocky ), further strengthening the connection we identified.

CopperDragon is an entity we track as a possible digital quartermaster supporting several China-nexus threat actors that use the cross-platform Sparrow framework.

We identified at least three activity clusters, each using its own main backdoor and targeting different regions and organizations:

SilentDelivery – Uses the newly discovered SquadC along with a variant of SparrowDoor in watering-hole attacks across Europe and Asia.

OceanGate – Operates primarily in Asia, uses a variant of SparrowDoor and SparrowShell , and shows possible links to Melofee .

DarkWire – Targets telecommunications operators and government organizations in Latin America and uses the new CopperDoor and CopperDNS backdoors.

These findings provide a foundation for understanding CopperDragon’s potential users and more precise tracking of activity previously grouped under the FamousSparrow umbrella. In the highly interconnected China-nexus threat ecosystem, shared malware and infrastructure can blur the boundaries between operators and campaigns. However, the use of the same backdoor or C2 infrastructure does not necessarily mean that two intrusions were conducted by the same actor.

SilentDelivery Campaign Files

SilentDelivery Campaign Infrastructure

OceanGate Campaign Files

OceanGate Campaign Infrastructure

DarkWire Campaign Files

DarkWire Campaign Infrastructure