CopperDragon Entity Supplies Sparrow Malware Framework to China-Nexus Threat Actors
Check Point Research has identified the CopperDragon entity, a potential supplier of the cross-platform Sparrow malware framework, to multiple China-nexus threat actors targeting organizations globally.
Check Point Research has unveiled the activities of an entity they've dubbed CopperDragon, identified as a potential supplier of the Sparrow malware framework to various China-nexus threat actors. This framework, designed for both Windows and Linux, has been utilized in sophisticated espionage campaigns targeting telecommunications providers, government organizations, military entities, research institutions, and critical infrastructure across Latin America, Asia, and Europe over the past year.
The investigation uncovered three distinct operational clusters—SilentDelivery, OceanGate, and DarkWire—which, despite employing different initial access techniques and toolsets, share common infrastructure features and malware code similarities. This shared DNA points to a centralized source for the Sparrow framework, with CopperDragon acting as a "digital quartermaster" for actors including FamousSparrow, Earth Estries, TropicTrooper, and UAT-9244, among others.
SilentDelivery, operating primarily in Europe and Asia, employs highly selective watering-hole attacks. Threat actors compromise legitimate websites frequented by their targets, injecting obfuscated JavaScript that replaces the site's content with a fake Google Chrome SSL certificate warning. This deceptive warning prompts users to install a "Certificate Fix" utility, which in turn deploys either a new backdoor named SquadC or a variant of SparrowDoor. The compromised websites belonged to government, shipping, and IT/research sectors.
OceanGate focuses its operations on Asian organizations, leveraging a variant of the SparrowDoor backdoor. This cluster initially compromises internet-facing Linux systems before moving laterally into Windows environments. They utilize a broad array of post-exploitation tools compatible with both operating systems, indicating a versatile and adaptable attack methodology.
The DarkWire cluster targets telecommunications providers and government organizations predominantly in Latin America. Their primary backdoors are CopperDoor and CopperDNS. This cluster's operations highlight the geographic reach and diverse targeting of the Sparrow framework ecosystem, demonstrating its utility across different regions and sectors.
Check Point Research's analysis also revealed previously undocumented tools and new details about the Sparrow framework itself. These include passive backdoor capabilities and a connection to the Melofee backdoor, suggesting a continuously evolving and expanding toolkit. The cross-platform nature of Sparrow, supporting both Windows and Linux, makes it a potent weapon for persistent, wide-ranging espionage operations.
The implications of CopperDragon's activities are significant, as it potentially lowers the barrier to entry for multiple threat actors by providing a sophisticated, shared malware framework. This centralized supply chain model allows for more efficient development and deployment of cyberespionage tools, making it harder to attribute attacks definitively and increasing the overall threat landscape for targeted organizations worldwide.