Check Point Links Three Espionage Clusters to the Sparrow Framework
Summary
Check Point Research links three espionage clusters—SilentDelivery, OceanGate and DarkWire—to the Sparrow framework and possible supplier CopperDragon, documenting new backdoors, intrusion chains, credential theft, rootkits and infrastructure overlaps.
Key points
- The year-long investigation identified SilentDelivery, OceanGate and DarkWire activity targeting telecommunications, government, military, research and critical infrastructure organizations across Europe, Asia and Latin America.
- Check Point tracks CopperDragon as a possible developer and supplier of the Sparrow framework; shared tools and infrastructure connect the clusters, but do not establish that the same actors conducted every intrusion.
- SilentDelivery used compromised websites and fake certificate warnings to deliver the newly identified SquadC backdoor or SparrowDoor; the cluster also used spear-phishing to distribute SquadC.
- OceanGate began with exploitation of an internet-facing Linux server and used backdoors, trojanized SSH tools to capture credentials, and Windows tools for reconnaissance, credential theft and lateral movement.
- OceanGate’s SparrowShell and SparrowDoor variants included rootkit or kernel-level capabilities; the researchers also found code and infrastructure similarities linking SparrowShell to Melofee.
- DarkWire used CopperLoader to deploy CopperDoor, CopperDNS and other tools, including a module for dumping LSASS memory; CopperDoor used call-stack spoofing and gadget-based execution for EDR evasion.
- The report documents detailed malware behaviors, infrastructure overlaps and indicators, while noting that shared malware or C2 infrastructure alone does not prove a common operator.
Article Details
- Attack Vectors
- SilentDelivery compromised websites visited by intended targets and injected JavaScript that displayed a fake Chrome certificate warning, prompting users to install a Trojanized MSI carrying SquadC or a SparrowDoor variant.
- SilentDelivery also distributed SquadC through a spear-phishing archive containing an LNK file that used ftp.exe to execute commands.
- OceanGate began with exploitation of a vulnerable internet-facing Linux server, followed by deployment of AnnobinDoor and SparrowShell.
- OceanGate replaced SSH client and SSHD components with Trojanized versions that logged credentials, then used harvested credentials to move to other Linux hosts.
- OceanGate attempted RDP logins to Windows hosts with multiple passwords and succeeded with an administrator account.
- DarkWire commonly used DLL sideloading to load its tools and backdoors; operators also transferred files over SMB and used WMI for remote commands.
- Defensive Notes
- Investigate unexpected certificate-repair utility installers and fake Chrome certificate warnings on websites frequented by targeted organizations.
- Check Linux hosts for unauthorized replacement of SSH client or SSHD components and investigate credential exposure associated with administrative SSH activity.
- Review Windows hosts for unexpected DLL sideloading, new hidden administrator accounts, changes to the Windows Run key, and unusual LSASS access.
- Review network activity for unexpected DNS MX-query tunneling, proxying, SSH tunneling, and remote access involving RDP, SMB, or WMI.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | aistei[.]com | Listed as SilentDelivery campaign infrastructure. |
| DOMAIN | amelicen[.]com | Reported as a SparrowDoor C2 domain and also observed in CopperDNS infrastructure. |
| DOMAIN | astorialaza[.]com | Listed as SilentDelivery campaign infrastructure. |
| DOMAIN | microscoft[.]vip | Listed as SilentDelivery campaign infrastructure. |
| DOMAIN | microsfot[.]vip | Listed as SilentDelivery campaign infrastructure. |
| DOMAIN | windefender[.]net | Listed as OceanGate campaign infrastructure. |
| DOMAIN | windowsdefender[.]it[.]com | Listed as OceanGate campaign infrastructure. |
| DOMAIN | windowsupdates[.]us | Listed as OceanGate campaign infrastructure. |
| IPV4 | 103[.]141[.]235[.]123 | Listed as SilentDelivery campaign infrastructure. |
| IPV4 | 103[.]215[.]216[.]117 | Listed as OceanGate campaign infrastructure. |
| IPV4 | 109[.]205[.]195[.]131 | Listed as campaign infrastructure in the article's operation infrastructure tables. |
| IPV4 | 135[.]136[.]135[.]54 | Listed as SilentDelivery campaign infrastructure. |
| IPV4 | 149[.]104[.]90[.]200 | Listed as OceanGate campaign infrastructure. |
| IPV4 | 216[.]185[.]57[.]152 | Listed as OceanGate campaign infrastructure. |
| IPV4 | 216[.]238[.]110[.]120 | Listed as DarkWire campaign infrastructure. |
| IPV4 | 38[.]54[.]57[.]12 | Listed as DarkWire campaign infrastructure. |
| IPV4 | 38[.]60[.]206[.]85 | Listed as DarkWire campaign infrastructure. |
| IPV4 | 45[.]80[.]208[.]195 | Listed as OceanGate campaign infrastructure. |
| SHA256 | 40880b6fce6f83df4e902cd29d7abb303ffa3f37c429c382f2aaeea34f7be074 | Hash of the OceanGate CopperAdu tool. |
| SHA256 | 417664cc34360d8519adc7a019408cf8f37f59c95a44e50092d73e38b7889a21 | Hash of the DarkWire CopperDNS backdoor in memory. |
| SHA256 | 4cafda69af3179ceb4a1f5ed864c501279796254709c86ca236be1cf74a8643f | Hash of a CopperLoader DLL associated with DarkWire. |
| SHA256 | 715c206629f59ff5b0134a33362162ce7a40a9b25aa17f0543dc9648d51a67cf | Hash of a SquadC CertFixer.msi installer. |
| SHA256 | 916a16a4a1eb7393b17574835312725e5cb146995a3cbcdf42fa8b9bebaa51b1 | Hash of the slave.dll component used by CopperLsass to dump LSASS memory. |
| SHA256 | 9fa421adb5c5dac3b2fc1165b0dddd596e82cfd3b08347a91d63f9e88d8718d0 | Hash of the OceanGate CopperLsa credential-collection tool. |
| SHA256 | cc3544ac194a4ab5f3a60dbedd270192bc01afd2a365b3b136b35d40d8dd3ff0 | Hash of a Trojanized SSH client used in OceanGate activity. |
| SHA256 | dbdaa8a52246b1e3f9285820db2f976b8ab513926ed972c968fae1c8aeb77056 | Hash of an OceanGate SparrowDoor variant. |
| SHA256 | de6a3140797f7c00a48b2068127965c3994f92867466259e69c861880e6ec2d8 | Hash of the DarkWire CopperDoor backdoor in memory. |
| SHA256 | e5f7bbfc187264336dea5dfebfb5a7dd1e7fcdcc9692db55fbe6eb4d28f027bc | Hash of a SquadC CertFixer.msi installer. |
| SHA256 | ee8c148518c5a416fc7d9b33246e9c98d955f2379aa9c82225e045322c97a043 | Hash of the PyProxy executable used in DarkWire activity. |
| SHA256 | fd0861a8269f2bb2fe0adfb4b4610d9675e68474503598f83e87c29b88906f99 | Hash of the DarkWire CopperLsass LSASS injector in memory. |
MITRE ATT&CK
T1003.001 · LSASS MemoryCopperLsass loaded a component into LSASS to create a memory dump, which was encrypted for collection.T1014 · RootkitSparrowShell could load a modified Reptile kernel rootkit to hide files, processes, and network activity.T1021.001 · Remote Desktop ProtocolOceanGate attempted RDP logins to Windows machines using multiple passwords and authenticated with an administrator account.T1047 · Windows Management InstrumentationDarkWire operators used WMI to execute remote commands.T1056.001 · KeyloggingCopperLogger captured keystrokes and associated window, process, session, and clipboard information.T1059.003 · Windows Command ShellThe spear-phishing LNK ran CMD commands to extract and execute SquadC; SquadC also supports arbitrary command execution.T1059.007 · JavaScriptInjected JavaScript checked the user's environment, contacted the C2, and changed the compromised webpage to display the fake certificate warning.T1071.004 · DNSCopperDNS used DNS MX queries to tunnel command-and-control communications.T1083 · File and Directory DiscoveryCopperList collected a recursive inventory of files, including paths, sizes, and timestamps.T1090 · ProxyAnnobinDoor and other tools provided SOCKS proxying, port forwarding, and tunneling for network pivoting.T1113 · Screen CaptureSquadC supports capturing full-screen screenshots.T1189 · Drive-by CompromiseSilentDelivery compromised legitimate websites visited by intended targets and injected JavaScript to initiate the watering-hole infection.T1204.002 · Malicious FileUsers were prompted to install and execute a Trojanized MSI posing as a certificate-repair utility.T1547.001 · Registry Run Keys / Startup FolderSquadC established persistence by manipulating the Windows Run key under WindowsUpdateAssist.T1574.002 · DLL Side-LoadingDarkWire commonly loaded tools through DLL sideloading, including CopperLoader.
Threat Actors
CopperDragonCheck Point tracks CopperDragon as the possible developer and supplier behind the Sparrow framework and a potential digital quartermaster supporting several China-nexus threat actors. The article links it to the operations based on shared infrastructure and code similarities.DarkWireA tracked activity cluster targeting telecommunications providers and government organizations, using CopperDoor and CopperDNS as primary backdoors.Earth EstriesNamed among China-nexus threat actors that may use the Sparrow framework and may be supported by CopperDragon; the article does not establish its involvement in the three examined clusters.FamousSparrowIdentified in the article as a threat actor whose main backdoor is SparrowDoor; the report describes infrastructure and toolset links between FamousSparrow-associated activity and the examined operations.OceanGateA tracked activity cluster that compromised internet-facing Linux systems, deployed backdoors and post-exploitation tools, and moved into Windows environments. Its TTPs were described as consistent with activity tracked as FamousSparrow.Salt TyphoonThe article says FamousSparrow was previously linked to Salt Typhoon, but notes that the relationship details remain unclear.SilentDeliveryA tracked activity cluster using watering-hole attacks to distribute SquadC and, in some cases, a SparrowDoor variant; Check Point attributes the activity to CopperDragon based on reported tool and infrastructure links.TropicTrooperNamed among China-nexus threat actors that may use the Sparrow framework and may be supported by CopperDragon; the article does not establish its involvement in the three examined clusters.
Malware
AnnobinDoorThe intrusion began with the exploitation of a vulnerable internet-facing Linux server, followed by the deployment of two new backdoors: AnnobinDoor and SparrowShell.CopperDNSDarkWire targets telecommunications providers and government organizations across Latin America, using CopperDoor and CopperDNS as its main backdoors.CopperDoorDarkWire targets telecommunications providers and government organizations across Latin America, using CopperDoor and CopperDNS as its main backdoors.MelofeeOur research uncovered several previously undocumented tools and new details about the Sparrow framework, including Windows and Linux variants, passive backdoor capabilities, and a connection to the Melofee backdoor.SparrowDoorFamousSparrow is a threat actor that was first identified in 2021, whose main backdoor is SparrowDoor.SparrowShellThe intrusion began with the exploitation of a vulnerable internet-facing Linux server, followed by the deployment of two new backdoors: AnnobinDoor and SparrowShell.SquadCSilentDelivery uses highly selective watering-hole attacks that distribute the SquadC backdoor through Trojanized MSI installers masquerading as certificate repair utilities.
Products
Google ChromeJavaScript payload injected into the page completely replaced the legitimate content with a Google Chrome SSL certificate warning customized to the website’s language.LinuxOur research uncovered several previously undocumented tools and new details about the Sparrow framework, including Windows and Linux variants, passive backdoor capabilities, and a connection to the Melofee backdoor.Microsoft WindowsOur research uncovered several previously undocumented tools and new details about the Sparrow framework, including Windows and Linux variants, passive backdoor capabilities, and a connection to the Melofee backdoor.OpenSSHTrojanized SSH Linux Modified OpenSSH client that captures passwords, authentication responses, and private-key passphrases.
Tools
ASimplePortScannerThe actor also used ASimplePortScanner, an open-source Python scanner, to discover additional hosts in the network.ChiselBesides custom tools and scripts, the threat actor also used popular publicly available tools, including FRPC and Chisel, which provided additional channels for remote access and internal pivoting.CopperAduCopperAdu is a post-exploitation tool that configures a compromised Windows host for remote administrative access, preparing it for further attacker activity.CopperListThe actor then deployed CopperList, a Windows reconnaissance tool that collects host information, disk details, and a recursive file inventory, including file paths, sizes, and timestamps.CopperLoaderMost of the post exploitation tools including the new backdoors were loaded by a unique loader we named CopperLoader.CopperLoggerOn some hosts, the actor deployed CopperLogger, a Raw Input-based keylogger.CopperLsaFor credential theft on Windows systems, the actor deployed CopperLsa, a tool that collects credentials directly through the Windows authentication flow.CopperLsassseveral additional custom tools, including proxy utilities such as CopperProxy and PyProxy, as well as CopperLsass, a dedicated module used to dump the LSASS process for credential harvesting.CopperProxythe actor was observed deploying several additional custom tools, including proxy utilities such as CopperProxy and PyProxy, as well as CopperLsass, a dedicated module used to dump the LSASS process for credentialfrpcBesides custom tools and scripts, the threat actor also used popular publicly available tools, including FRPC and Chisel, which provided additional channels for remote access and internal pivoting.PyProxyobserved deploying several additional custom tools, including proxy utilities such as CopperProxy and PyProxy, as well as CopperLsass, a dedicated module used to dump the LSASS process for credential harvesting.ReptileThe kernel component is a modified version of the open-source Reptile rootkit and supports capabilities such as hiding files, processes, and network activity.SoftEther VPNAlongside these tools, the operators also employed publicly available software, such as SoftEther VPN renamed to names like vmtoolsd.exe and csrss.exe.WinDivertSome observed versions of the Windows backdoor SparrowDoor include kernel-level packet interception capabilities, with WinDivert drivers embedded as resources for x86 and x64.wmiexecFor lateral movement, they transferred files over SMB and executed remote commands via WMI, using wmiexec.
Countries
Czech RepublicBased on Check Point telemetry, the operations primarily targeted organizations in countries such as the Czech Republic, Germany, France, Taiwan, Nepal, Hong Kong and Indonesia.FranceBased on Check Point telemetry, the operations primarily targeted organizations in countries such as the Czech Republic, Germany, France, Taiwan, Nepal, Hong Kong and Indonesia.GermanyBased on Check Point telemetry, the operations primarily targeted organizations in countries such as the Czech Republic, Germany, France, Taiwan, Nepal, Hong Kong and Indonesia.Hong KongBased on Check Point telemetry, the operations primarily targeted organizations in countries such as the Czech Republic, Germany, France, Taiwan, Nepal, Hong Kong and Indonesia.IndonesiaBased on Check Point telemetry, the operations primarily targeted organizations in countries such as the Czech Republic, Germany, France, Taiwan, Nepal, Hong Kong and Indonesia.NepalBased on Check Point telemetry, the operations primarily targeted organizations in countries such as the Czech Republic, Germany, France, Taiwan, Nepal, Hong Kong and Indonesia.TaiwanBased on Check Point telemetry, the operations primarily targeted organizations in countries such as the Czech Republic, Germany, France, Taiwan, Nepal, Hong Kong and Indonesia.
Industries
Critical infrastructureproviders, government organizations, military entities, research institutions, and critical infrastructure.Governmentoperational clusters spanning Latin America, Asia, and Europe targeting telecommunications providers, government organizations, military entities, research institutions, and critical infrastructure.MilitaryLatin America, Asia, and Europe targeting telecommunications providers, government organizations, military entities, research institutions, and critical infrastructure.Researchhttps://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/ShippingThe compromised websites that were used for watering hole attacks were of government, shipping, and IT and research sectors.Telecommunicationsidentified three distinct operational clusters spanning Latin America, Asia, and Europe targeting telecommunications providers, government organizations, military entities, research institutions, and critical