Not All That Glitters Is Gold: Tracking CopperDragon’s Sparrow Framework Around the Globe
Source Check Point Research
Description
CopperDragon is a digital quartermaster entity linked to multiple China-nexus threat actors using the Sparrow malware framework to target telecommunications providers, government organizations, military entities, research institutions, and critical infrastructure across Latin America, Asia, and Europe. The threat operates through three distinct clusters—SilentDelivery, OceanGate, and DarkWire—each employing different toolsets and initial access techniques, including selective watering-hole attacks and compromising internet-facing infrastructure. The malware framework includes Windows and Linux variants with passive backdoor capabilities and connections to other backdoors like Melofee. SilentDelivery notably uses Trojanized MSI installers disguised as certificate repair utilities delivered via compromised websites in government, shipping, and IT sectors. The campaigns have been ongoing for over a year, targeting high-profile organizations with sophisticated multi-stage infection chains.