Three China-nexus intrusion clusters across Latin America, Asia and Europe have been linked through shared malware and infrastructure to a possible common supplier of hacking tools.
Check Point Research (CPR) detailed the findings in a November 10 report, linking the clusters through shared infrastructure features and code similarities within the Sparrow framework.
The year-long investigation covered campaigns targeting several dozen high-profile organizations across the three regions. CPR called the suspected supplier behind the framework 'CopperDragon.'
Three Clusters Share Sparrow Framework
The three clusters are tracked by CPR researchers as SilentDelivery, OceanGate and DarkWire.
SilentDelivery, observed since early 2026, has compromised legitimate websites, mainly in government, shipping and IT or research sectors.
Visitors were shown a fake Chrome certificate warning that prompted them to install a "Certificate Fix" utility, with targets mainly in the Czech Republic, Germany, France, Taiwan, Nepal, Hong Kong and Indonesia. The fake utility delivered SquadC or a SparrowDoor variant, giving the attackers an initial foothold.
OceanGate was observed during 2025 and 2026 and mainly targeted government organizations and critical infrastructure in Asia. CPR said attackers entered through an internet-facing Linux server before moving into Windows environments and conducting extensive credential theft, lateral movement and exfiltration of sensitive operational information.
DarkWire, first identified in mid-2025, initially concentrated on Latin America but more recent intrusions suggested expansion. The cluster has targeted telecom operators, including at least three major providers in the region, as well as foreign affairs and justice bodies.
CopperDragon May Sit Behind Multiple Groups
CPR described CopperDragon as "a potential digital quartermaster supporting China-nexus threat actors" and the Sparrow framework's "possible developer and supplier." It also assessed that CopperDragon is involved in maintaining and supplying variants of the Melofee backdoor.
The report links the framework to FamousSparrow, first identified in 2021 and known for using the SparrowDoor backdoor. CPR said Earth Estries, TropicTrooper and UAT-9244 use a shared toolset "potentially supplied by the same entity," and noted that FamousSparrow was previously also linked to Salt Typhoon, though the details of that relationship remain unclear.
Read more on FamousSparrow: FamousSparrow Swaps SparrowDoor For New SparroWocky Backdoor
For DarkWire, CPR said it did not identify direct code similarities with the CopperDragon toolset. The link instead rests on infrastructure tied to a previously reported FamousSparrow domain.
Shared malware and infrastructure "can blur the boundaries between operators and campaigns," CPR wrote, presenting its findings as a basis for tracking activity long grouped under FamousSparrow more precisely.