Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem
Three distinct threat activity clusters with shared infrastructure and malware code similarities have been observed targeting telecommunications providers, government organizations, military entities, research institutions, and critical infrastructure across Latin America, Asia, and Europe over the past year.
Three distinct threat activity clusters with shared infrastructure and malware code similarities have been observed targeting telecommunications providers, government organizations, military entities, research institutions, and critical infrastructure across Latin America, Asia, and Europe over the past year.
Check Point Research is tracking the clusters under the names SilentDelivery, OceanGate, and DarkWire.
Although initially assumed to be independent sets of attacks, each with its own backdoors and post-exploitation tooling, they have all been linked through a malware ecosystem called Sparrow.
Visitors to the sites are greeted by a Google Chrome SSL certificate warning that instructs users to install a Certificate Fix utility to restore access.
All the compromised websites have been found to be related to government, shipping, IT, and research sectors in the Czech Republic, Germany, France, Taiwan, Nepal, Hong Kong, and Indonesia.
According to a report published by Positive Technologies in August 2026, there are indications that the campaign has also targeted entities in Egypt and the Philippines using this method.
The cyber espionage ecosystem linked to CopperDragon is driven by three prominent clusters - The SilentDelivery chain begins with the attacker injecting heavily obfuscated JavaScript into legitimate websites frequented by their intended targets.
The script then repeatedly sends status-check requests to a command-and-control (C2) server to fingerprint the user based on IP and geolocation, and ultimately decide whether to continue the attack and serve the fake warning.
The OceanGate operation, on the other hand, has been observed targeting both Windows and Linux environments, deploying previously undocumented tooling to maintain access, move laterally across the network, and exfiltrate sensitive data.
This step is followed by the deployment of bespoke post-exploitation tools and a variant of SparrowDoor - What's more, the threat actor has been found incorporating kernel rootkits and kernel-level access capabilities into SparrowDoor and SparrowShell to evade defenses through process hiding and to capture and manipulate network packet capture using WinDivert drivers.
Attacks mounted by FamousSparrow are known for deploying backdoors like SparrowDoor (and its variants Crowdoor and TernDoor), SparroWocky, and HemiGate.
Written in C/C++, SquadC is a Windows backdoor that enables initial foothold over the infected host.
The so-called utility, once deployed, delivers either SquadC or a SparrowDoor variant, and it establishes persistence by means of a Windows Registry Run key that masquerades as a Windows update assistant.
What happened
Three distinct threat activity clusters with shared infrastructure and malware code similarities have been observed targeting telecommunications providers, government organizations, military entities, research institutions, and critical infrastructure across Latin America, Asia, and Europe over the past year.
Check Point Research is tracking the clusters under the names SilentDelivery, OceanGate, and DarkWire.
Although initially assumed to be independent sets of attacks, each with its own backdoors and post-exploitation tooling, they have all been linked through a malware ecosystem called Sparrow.
What changed
Visitors to the sites are greeted by a Google Chrome SSL certificate warning that instructs users to install a Certificate Fix utility to restore access.
All the compromised websites have been found to be related to government, shipping, IT, and research sectors in the Czech Republic, Germany, France, Taiwan, Nepal, Hong Kong, and Indonesia.
According to a report published by Positive Technologies in August 2026, there are indications that the campaign has also targeted entities in Egypt and the Philippines using this method.
Who is affected
The cyber espionage ecosystem linked to CopperDragon is driven by three prominent clusters - The SilentDelivery chain begins with the attacker injecting heavily obfuscated JavaScript into legitimate websites frequented by their intended targets.
The script then repeatedly sends status-check requests to a command-and-control (C2) server to fingerprint the user based on IP and geolocation, and ultimately decide whether to continue the attack and serve the fake warning.
Why it matters
The OceanGate operation, on the other hand, has been observed targeting both Windows and Linux environments, deploying previously undocumented tooling to maintain access, move laterally across the network, and exfiltrate sensitive data.
This step is followed by the deployment of bespoke post-exploitation tools and a variant of SparrowDoor - What's more, the threat actor has been found incorporating kernel rootkits and kernel-level access capabilities into SparrowDoor and SparrowShell to evade defenses through process hiding and to capture and manipulate network packet capture using WinDivert drivers.
Technical details
Attacks mounted by FamousSparrow are known for deploying backdoors like SparrowDoor (and its variants Crowdoor and TernDoor), SparroWocky, and HemiGate.
Written in C/C++, SquadC is a Windows backdoor that enables initial foothold over the infected host.
Response
The so-called utility, once deployed, delivers either SquadC or a SparrowDoor variant, and it establishes persistence by means of a Windows Registry Run key that masquerades as a Windows update assistant.
What remains unknown
However, the precise nature of the relationship remains unclear.
What to watch next
Watch for additional victim details, indicators of compromise and follow-on exploitation reports.
Watch for revised vendor guidance, fixed versions and mitigation updates.