- What: Check Point Research linked three China-nexus espionage clusters, SilentDelivery, OceanGate and DarkWire, through a shared malware ecosystem called Sparrow, built by a digital quartermaster it tracks as CopperDragon.
- Impact: Telecommunications providers, government bodies, military entities, research institutions and critical infrastructure across Latin America, Asia and Europe have been targeted over the past year with backdoors, keyloggers, credential stealers and kernel rootkits.
- Fix / mitigation: No single vendor patch applies: the main exposures are internet-facing Linux servers, weak administrator passwords reachable over RDP, and users persuaded by fake Chrome certificate warnings, and Check Point and Positive Technologies have published technical reports on the tooling.
- Who's at risk: Telecoms, government, defense, shipping, IT and research organizations in Latin America, Asia and Europe are most at risk, along with any organization whose staff regularly visit sector websites in those regions.
Three espionage campaigns that looked unrelated turn out to share one supplier. Check Point Research has linked the SilentDelivery, OceanGate and DarkWire clusters through a common malware ecosystem called Sparrow. Over the past year these clusters have hit telecommunications providers, government organizations, military entities, research institutions and critical infrastructure in Latin America, Asia and Europe. The developer behind Sparrow, tracked as CopperDragon, is assessed to be a digital quartermaster that supplies tools to at least five China-nexus groups: FamousSparrow, Earth Estries, Tropic Trooper, UAT-9244 and UAT-8302.
This matters for defenders. When one supplier arms several operators, an intrusion by one group can share code, infrastructure and behavior with another group's intrusion. Treating each cluster as a separate threat leaves those links unseen.
The Quartermaster Model
Check Point first assessed the three clusters as independent. Each used its own backdoors, its own post-exploitation tooling and its own way in. Shared infrastructure and code similarities later tied them to the Sparrow ecosystem. The best-known Sparrow family is SparrowDoor, along with its variants Crowdoor and TernDoor. FamousSparrow also deploys SparroWocky and HemiGate. FamousSparrow has some overlap with Salt Typhoon, the group behind well-known telecom intrusions, but the exact relationship is unclear.
Five named China-nexus groups draw on one tool developer. Detection logic written for SparrowDoor in one campaign may catch activity from a different operator, and a gap in that logic is a gap against all of them.
SilentDelivery: Fake Certificate Warnings on Trusted Sites
SilentDelivery has been active since early 2026 and runs highly selective watering hole attacks against targets in Europe and Asia. The operators inject heavily obfuscated JavaScript into legitimate websites their targets visit. The compromised sites belong to government, shipping, IT and research organizations in the Czech Republic, Germany, France, Taiwan, Nepal, Hong Kong and Indonesia. A Positive Technologies report from August 2026 adds signs of targeting in Egypt and the Philippines.
The script is obfuscated with jsjiami, a public JavaScript obfuscation service. It checks that the visitor runs Windows and, in some cases, that the page is on the intended compromised domain. It then sends repeated status checks to a command-and-control server, which fingerprints the visitor by IP address and geolocation and decides whether to continue. Visitors who pass see a fake Google Chrome SSL certificate warning telling them to install a "Certificate Fix" utility. That utility is a trojanized MSI installer that delivers either SquadC or a SparrowDoor variant.
SquadC, also known as SquawkDoor, is a Windows backdoor written in C/C++. It persists through a Registry Run key disguised as a Windows update assistant. Check Point also found it spreading by phishing against Indonesian organizations. Those emails carry an LNK shortcut disguised as a PDF. Opening it abuses the legitimate ftp.exe binary to run a batch script, which shows an empty decoy file and launches SquadC through DLL sideloading.
OceanGate: From Linux Edge to Windows Domain
OceanGate ran from 2025 to 2026 and focused mainly on Asian organizations. Initial access came through internet-facing Linux servers. Two previously undocumented Linux backdoors held that foothold:
- AnnobinDoor: a Go-based backdoor with remote access, an interactive shell, file management, SOCKS proxying, SSH tunneling, port forwarding and reverse connections. It turns the infected host into both a remote shell and an internal network pivot.
- SparrowShell: a modular Linux backdoor that overlaps with its Windows counterpart, SparrowDoor.
After collecting credentials from several Linux users, the operators moved into Windows. They tried RDP logins on several Windows machines, cycling through passwords until one administrator account worked. They then deployed a SparrowDoor variant and four custom post-exploitation tools:
- CopperAdu: configures a compromised Windows machine for remote administrative access.
- CopperList: reconnaissance that collects host details, disk information and a recursive file inventory with paths, sizes and timestamps.
- CopperLogger: a Raw Input keylogger that also records clipboard activity, active window titles and the associated process names and paths.
- CopperLsa: collects passwords, hashes and authentication tokens from NTLM and Kerberos.
Check Point also reports that the actor has added kernel rootkits and kernel-level access to SparrowDoor and SparrowShell to evade defenses. Kernel-level tooling makes host-based detection much less reliable once the implant is in place.
DarkWire: Latin American Telecoms and Government
DarkWire dates to mid-2025 and targets telecommunications providers and government organizations across Latin America. It uses two backdoors, CopperDoor (also known as SparroWocky) and CopperDNS. Because SparroWocky is already tied to FamousSparrow, DarkWire is the most direct link between the quartermaster's output and a known operator.
SilentDelivery uses watering holes and phishing, OceanGate uses exposed Linux servers and RDP password guessing, and DarkWire goes after telecom and government networks. The entry points differ, but the implants come from the same Sparrow lineage.
Assessment
No CVE ties this activity together, so there is no single patch to apply. The exposures are structural. Internet-facing Linux servers gave OceanGate its first foothold. An administrator password that could be guessed over RDP let it cross into Windows. Users who trust a browser-style certificate warning on a familiar site gave SilentDelivery its foothold. The watering holes are narrowly targeted and filter visitors by OS, domain, IP and location, so most visitors to a compromised site never see the payload. That makes the compromise harder to spot from outside.
For telecoms, government agencies and research institutions in the affected regions, the key point is attribution. An alert for SparrowDoor, SquadC or a Copper tool should not be scoped to one campaign. It points to an ecosystem that supplies at least five operators with credential theft, keylogging, network pivoting and kernel-level persistence. Check Point and Positive Technologies have published technical detail on the tooling for teams that want to compare it against their own telemetry.
RedEye Security tracks China-nexus activity against telecom, government and critical infrastructure environments. If your organization runs internet-facing Linux infrastructure or operates in the sectors and regions named here, a RedEye assessment can determine whether Sparrow ecosystem tooling is present and how far an intrusion like OceanGate could reach in your environment.
Questions about your exposure?
RedEye Security provides assessments for organizations that need to understand their real risk.
Talk to us