Skip to content
CopperDragon's Sparrow Framework Targets Global Telecoms and Governments

CopperDragon's Sparrow Framework Targets Global Telecoms and Governments

First seen 10 Nov 2026, 19:20 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 10, 2026 at 19:21 UTC
  • •Three clusters linked to CopperDragon target global telecoms and governments.
  • •Attacks utilize watering hole techniques and malware variants like SparrowDoor.
  • •Campaigns are assessed to support China-nexus threat actors.

Check Point Research has identified three interconnected cyber espionage clusters—SilentDelivery, OceanGate, and DarkWire—targeting telecommunications, government, military, and critical infrastructure across Latin America, Asia, and Europe. These clusters are linked through shared malware code and infrastructure, all part of the Sparrow malware ecosystem, attributed to the entity CopperDragon. The attacks employed various techniques, including watering hole attacks and compromising internet-facing infrastructure. Notable tools used include SparrowDoor and its variants, with specific campaigns targeting entities in countries such as Germany, France, Taiwan, and Indonesia. The research indicates that these operations may be state-sponsored, supporting China-nexus threat actors. The ongoing nature of these campaigns raises significant concerns for affected sectors.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 2h ago How this analysis works

Timeline

2026-11-10
Check Point Research report published
Check Point Research detailed three espionage clusters linked to CopperDragon targeting various sectors across multiple continents.
Research.Checkpoint
2026-11-10
The Hacker News report published
The Hacker News reported on the same espionage clusters and their tactics, confirming the findings of Check Point Research.
Thehackernews

More articles in this cluster (8)

Following this threat?

Track AnnobinDoor in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (37)

1 / 4

Common questions

What sectors are targeted by these campaigns?
The campaigns target telecommunications providers, government organizations, military entities, research institutions, and critical infrastructure.
What techniques are being used in these attacks?
The attacks employ various methods, including watering hole attacks and compromising internet-facing infrastructure.
Is there evidence of state sponsorship?
Yes, the activities are assessed to support China-nexus threat actors, indicating potential state sponsorship.