Check Point Links Three China-Nexus Espionage Clusters to Sparrow Malware Ecosystem
Summary
Check Point Research links SilentDelivery, OceanGate and DarkWire to the Sparrow malware ecosystem, detailing watering-hole and phishing delivery, Windows and Linux operations, and kernel-level techniques used to hide backdoor traffic.
Key points
- Check Point Research linked the SilentDelivery, OceanGate and DarkWire clusters through shared infrastructure and malware-code similarities in the Sparrow ecosystem.
- CopperDragon is assessed to develop and supply tools for China-nexus threat actors, including FamousSparrow, Earth Estries and Tropic Trooper.
- SilentDelivery injects obfuscated JavaScript into compromised websites and uses a fake Chrome certificate warning to deliver SquadC or a SparrowDoor variant.
- SquadC is also distributed through phishing emails with an LNK disguised as a PDF; the attack abuses ftp.exe and DLL sideloading, and SquadC establishes persistence through a Windows Registry Run key.
- OceanGate activity spans Windows and Linux; the report describes credential harvesting, movement from Linux to Windows over RDP, and attempts to exfiltrate sensitive data.
- The report says kernel-level capabilities and WinDivert drivers let SparrowDoor and SparrowShell hide processes and manipulate network packets to make backdoor traffic less visible.
- A Latin America-focused cluster deployed the newly identified CopperDoor and CopperDNS backdoors; operators reportedly used DLL sideloading and existing system paths to reduce their footprint.
Article Details
- Attack Vectors
- Watering-hole attacks injected obfuscated JavaScript into compromised websites and presented visitors with a fake Chrome certificate warning prompting them to install a utility.
- Phishing emails targeting Indonesian organizations carried a Windows Shortcut disguised as a PDF; opening it used ftp.exe to run a batch script and launch SquadC through DLL sideloading.
- OceanGate harvested credentials in Linux environments, then attempted repeated password-based RDP logins to Windows machines until an administrator account authenticated.
- Operators used DLL sideloading and placed tools in existing system paths rather than creating new directories.
- A kernel-level driver was used to intercept and rewrite network packets, allowing SparrowDoor to receive connections through a port used by a legitimate service.
MITRE ATT&CK
T1014 · RootkitThe article reports kernel rootkits and kernel-level access capabilities used for process hiding and defense evasion.T1021.001 · Remote Desktop ProtocolAfter moving from Linux to Windows, the OceanGate actor attempted to log in to several Windows machines over RDP.T1036 · MasqueradingSquadC's Registry Run key masqueraded as a Windows update assistant, and a phishing Shortcut was disguised as a PDF.T1040 · Network SniffingThe article says a WinDivert driver was used to capture and manipulate network packets at the kernel level.T1041 · Exfiltration Over C2 ChannelThe OceanGate operation was observed exfiltrating sensitive data.T1059.003 · Windows Command ShellA batch script launched through the phishing Shortcut displayed a decoy file while launching SquadC.T1059.007 · JavaScriptThe watering-hole JavaScript checked for Windows and domain conditions, fingerprinted visitors, and determined whether to serve a fake warning.T1110.001 · Password GuessingIn the OceanGate operation, the actor tried different passwords against Windows machines until an administrator account authenticated.T1189 · Drive-by CompromiseSilentDelivery injected JavaScript into compromised websites frequented by intended targets for watering-hole attacks.T1204.002 · Malicious FileOpening the disguised Windows Shortcut launched the chain that executed a batch script and SquadC.T1547.001 · Registry Run Keys / Startup FolderSquadC established persistence using a Windows Registry Run key disguised as a Windows update assistant.T1566.001 · Spearphishing AttachmentPhishing emails targeting Indonesian organizations carried a Windows Shortcut disguised as a PDF.T1574.002 · DLL Side-LoadingThe phishing chain launched SquadC through DLL sideloading; DLL sideloading was also described as a primary execution technique in the Latin America operations.
Threat Actors
CopperDragonCheck Point assesses CopperDragon to be the entity behind the Sparrow framework and a digital quartermaster developing tools for China-nexus threat actors.DarkWireCheck Point Research tracks DarkWire as one of three threat activity clusters linked through the Sparrow malware ecosystem.Earth EstriesThe article names Earth Estries among the China-nexus threat actors for which CopperDragon is assessed to develop tools.FamousSparrowThe article associates FamousSparrow with deploying SparrowDoor and other backdoors, and says CopperDragon develops tools for it. Its reported overlap with Salt Typhoon is described as unclear.OceanGateCheck Point Research tracks OceanGate as a cluster that targeted Windows and Linux environments, maintained access, moved laterally, and exfiltrated data.Salt TyphoonThe article says FamousSparrow is assessed to share some degree of overlap with Salt Typhoon, but that the precise nature of the relationship remains unclear.SilentDeliveryCheck Point Research tracks SilentDelivery as a threat activity cluster that used watering-hole attacks to deliver SquadC or SparrowDoor variants.Tropic TrooperThe article names Tropic Trooper among the China-nexus threat actors for which CopperDragon is assessed to develop tools.UAT-8302The article names UAT-8302 among the China-nexus threat actors for which CopperDragon is assessed to develop tools.
Malware
CopperDNSentities. These attacks led to the deployment of two newly identified backdoors called CopperDoor and CopperDNS as a possible replacement for SparrowDoor.CopperDoorand government entities. These attacks led to the deployment of two newly identified backdoors called CopperDoor and CopperDNS as a possible replacement for SparrowDoor.CrowDoorAttacks mounted by FamousSparrow are known for deploying backdoors like SparrowDoor (and its variants Crowdoor and TernDoor), SparroWocky, and HemiGate. It's also assessed to share some degree of overlap with SaltHemigatefor deploying backdoors like SparrowDoor (and its variants Crowdoor and TernDoor), SparroWocky, and HemiGate. It's also assessed to share some degree of overlap with Salt Typhoon. However, the precise nature ofMéloféeInterestingly, SparrowShell shares code- and infrastructure-level similarities with a malware called Mélofée that was first described by ExaTrack in March 2023 as based on the open-source Reptile rootkit. This hasSparrowDoorAttacks mounted by FamousSparrow are known for deploying backdoors like SparrowDoor (and its variants Crowdoor and TernDoor), SparroWocky, and HemiGate. It's also assessed to share some degree of overlap with SaltSparroWockyare known for deploying backdoors like SparrowDoor (and its variants Crowdoor and TernDoor), SparroWocky, and HemiGate. It's also assessed to share some degree of overlap with Salt Typhoon. However, theSparrowShellhas been found incorporating kernel rootkits and kernel-level access capabilities into SparrowDoor and SparrowShell to evade defenses through process hiding and to capture and manipulate network packet capture usingSquadCThe so-called utility, once deployed, delivers either SquadC or a SparrowDoor variant. All the compromised websites have been found to be related to government, shipping, IT, and research sectors in the Czech Republic,TernDoorby FamousSparrow are known for deploying backdoors like SparrowDoor (and its variants Crowdoor and TernDoor), SparroWocky, and HemiGate. It's also assessed to share some degree of overlap with Salt Typhoon.
Products
Google Chromeinto legitimate websites frequented by their intended targets. Visitors to the sites are greeted by a Google Chrome SSL certificate warning that instructs users to install a "Certificate Fix" utility to restore access.LinuxThe OceanGate operation, on the other hand, has been observed targeting both Windows and Linux environments, deploying previously undocumented tooling to maintain access, move laterally across the network, andMicrosoft WindowsJavaScript obfuscation service," Check Point said. "It first checks whether the user is running Windows and, in some cases, verifies that the website’s domain matches the intended compromised domain."
Tools
jsjiami"The JavaScript injected into the compromised websites is heavily obfuscated using jsjiami, a publicly available JavaScript obfuscation service," Check Point said. "It first checks whether the user is running WindowsWinDivertto evade defenses through process hiding and to capture and manipulate network packet capture using WinDivert drivers.
Countries
Czech Republicwebsites have been found to be related to government, shipping, IT, and research sectors in the Czech Republic, Germany, France, Taiwan, Nepal, Hong Kong, and Indonesia.EgyptAccording to a report published by Positive Technologies in August 2026, there are indications that the campaign has also targeted entities in Egypt and the Philippines using this method.Francefound to be related to government, shipping, IT, and research sectors in the Czech Republic, Germany, France, Taiwan, Nepal, Hong Kong, and Indonesia.Germanyhave been found to be related to government, shipping, IT, and research sectors in the Czech Republic, Germany, France, Taiwan, Nepal, Hong Kong, and Indonesia.Hong Konggovernment, shipping, IT, and research sectors in the Czech Republic, Germany, France, Taiwan, Nepal, Hong Kong, and Indonesia.IndonesiaIT, and research sectors in the Czech Republic, Germany, France, Taiwan, Nepal, Hong Kong, and Indonesia.Nepalrelated to government, shipping, IT, and research sectors in the Czech Republic, Germany, France, Taiwan, Nepal, Hong Kong, and Indonesia.PhilippinesAccording to a report published by Positive Technologies in August 2026, there are indications that the campaign has also targeted entities in Egypt and the Philippines using this method.Taiwanto be related to government, shipping, IT, and research sectors in the Czech Republic, Germany, France, Taiwan, Nepal, Hong Kong, and Indonesia.
Industries
Critical infrastructureproviders, government organizations, military entities, research institutions, and critical infrastructure across Latin America, Asia, and Europe over the past year.Governmentinfrastructure and malware code similarities have been observed targeting telecommunications providers, government organizations, military entities, research institutions, and critical infrastructure across LatinITtoday. "The compromised websites that were used for watering hole attacks were of government, shipping, and IT and research sectors."Militarycode similarities have been observed targeting telecommunications providers, government organizations, military entities, research institutions, and critical infrastructure across Latin America, Asia, and Europe overResearchhave been observed targeting telecommunications providers, government organizations, military entities, research institutions, and critical infrastructure across Latin America, Asia, and Europe over the past year.Shippingpublished today. "The compromised websites that were used for watering hole attacks were of government, shipping, and IT and research sectors."Telecommunicationsclusters with shared infrastructure and malware code similarities have been observed targeting telecommunications providers, government organizations, military entities, research institutions, and critical