Not All That Glitters Is Gold: Tracking CopperDragon’s Sparrow Framework Around the Globe
Check Point tracks CopperDragon as likely Sparrow framework developer supplying China-nexus threat actors.
Check Point Research identified CopperDragon, a potential digital quartermaster behind the Sparrow malware framework, operating three distinct attack clusters (SilentDelivery, OceanGate, DarkWire) across Latin America, Asia, and Europe targeting telecom, government, military, and critical infrastructure. The clusters share infrastructure features and malware code similarities, and CopperDragon likely supplies multiple China-nexus threat actors including FamousSparrow, Earth Estries, TropicTrooper, and UAT-9244. The investigation uncovered previously undocumented tools and new details about Windows and Linux variants of Sparrow, passive backdoor capabilities, and connections to the Melofee backdoor.
AI summary of the linked source. Not reviewed by an editor. How this works
The lesson from this incident
Full lessonCopperDragon operates as a digital quartermaster, supplying the Sparrow malware framework and supporting infrastructure to multiple China-nexus threat actors targeting telecom, government, military, and critical infrastructure across three continents. This supply-chain model of cyber operations means that a single tooling provider enables a wide range of intrusions, making attribution harder and amplifying the reach of any single actor's capabilities. The use of passive backdoors and previously undocumented tools further indicates that defenders were failing to detect long-term persistent access across affected networks. The shared infrastructure and code similarities across clusters highlight that threat intelligence sharing and cross-organizational detection are essential — what one victim sees may be the key to uncovering attacks on others. Organizations in targeted sectors must assume that advanced persistent threat groups have access to mature, supplier-backed toolkits specifically engineered to evade standard defenses.
What helps against this
How we list vendors
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Network detection and response (NDR)
Attackers moving between systems inside the network get seen.
- Threat intelligence
Attack campaigns reach your sector, suppliers or software before your team hears about them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — Sparrow
- malware — SparrowDoor
- malware — SquadC
- malware — CrowDoor
- malware — HemiGate
- malware — TernDoor
- malware — Melofee