Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem
Three China-nexus espionage campaigns linked by Sparrow malware ecosystem targeting global entities.
Three distinct threat activity clusters, SilentDelivery, OceanGate, and DarkWire, have been linked through the Sparrow malware ecosystem, with shared infrastructure and code similarities. These campaigns, attributed to China-nexus actors codenamed CopperDragon, have targeted telecommunications providers, government organizations, military entities, research institutions, and critical infrastructure across Latin America, Asia, and Europe over the past year. Each cluster employed different initial access techniques and toolsets, including watering hole attacks and compromising internet-facing infrastructure.
AI summary of the linked source. Not reviewed by an editor. How this works
The lesson from this incident
Full lessonThree coordinated threat clusters attributed to China-nexus actors exploited internet-facing infrastructure and watering hole attacks to compromise telecommunications, government, military, and research targets across multiple continents. The campaigns were connected through shared malware code and infrastructure — a pattern that persisted undetected long enough to span a full year of activity. This highlights how advanced persistent threat (APT) actors reuse and evolve tooling across campaigns, making detection harder when defenders lack visibility into code-level and infrastructure-level similarities. The targeting of critical infrastructure sectors underscores that organizations must assume they are high-value targets and invest in proactive threat intelligence and anomaly detection. Failure to monitor for shared indicators of compromise across campaigns allows attackers to operate persistently with minimal friction.
What helps against this
How we list vendors
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Network detection and response (NDR)
Attackers moving between systems inside the network get seen.
- Threat intelligence
Attack campaigns reach your sector, suppliers or software before your team hears about them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — SparrowDoor
- malware — Crowdoor
- malware — TernDoor
- malware — SparroWocky
- malware — HemiGate
- malware — SquadC
- malware — SquawkDoor
- malware — CopperDoor