Visitors to compromised government, shipping and research websites in Europe and Asia were met with a fake Chrome certificate error, translated into the site's own language, and a button offering to install a "Certificate Fix" utility. Clicking it delivered a backdoor. That watering-hole operation is one of three espionage campaigns that Check Point Research now ties to a single malware ecosystem, the Sparrow framework.
After a year-long investigation, Check Point tracks the entity behind that framework as CopperDragon, which it describes as a potential digital quartermaster supplying tools to several China-nexus groups, including FamousSparrow, Earth Estries, TropicTrooper and UAT-9244. FamousSparrow has previously been linked to Salt Typhoon, though Check Point says the details of that relationship remain unclear.
Three campaigns that looked unrelated
The clusters, which together targeted several dozen high-profile organizations, initially appeared independent because each used different backdoors and initial access methods. Check Point linked them through shared infrastructure and code similarities.
- SilentDelivery began in early 2026 and used watering-hole attacks to push a previously undocumented backdoor, SquadC, or a SparrowDoor variant, through trojanized MSI installers. Check Point telemetry shows targets mainly in the Czech Republic, Germany, France, Taiwan, Nepal, Hong Kong and Indonesia. The same backdoor also turned up in a spear-phishing archive, Strategi_AS_Referensi_April2026.rar, uploaded from Indonesia.
- OceanGate, active in 2025 and 2026, hit government and critical infrastructure organizations mainly in Asia. It started on a vulnerable internet-facing Linux server and moved into Windows.
- DarkWire targets telecommunications providers and government organizations across Latin America with backdoors Check Point calls CopperDoor and CopperDNS.
The Linux side of a Windows-famous toolkit
OceanGate gives the clearest look at how the actor works on Linux, an area with little prior reporting. After initial access it deployed AnnobinDoor, a Go backdoor that disguises its traffic as ordinary WebSocket sessions, and SparrowShell, a modular Linux backdoor that shares C2 infrastructure, encryption keys and a plugin design with the Windows SparrowDoor. A few days later the attackers replaced the server's SSH client and daemon with trojanized versions that logged administrators' credentials, then reused those credentials to move to more Linux hosts.
Once in Windows, the actor brute-forced its way to an administrator account over RDP and deployed a set of custom tools: CopperAdu, which creates a hidden local admin account and opens SMB on port 445, CopperList for file inventories, the CopperLogger keylogger, and CopperLsa, which installs a custom LSA security package inside LSASS to collect passwords, hashes and Kerberos tokens. In some cases Check Point saw kernel rootkits added to both SparrowDoor and SparrowShell. The research also connects the framework to the Melofee backdoor.
Check telemetry for the fake certificate fix
For defenders, a few concrete hooks stand out from the report:
- Any "certificate fix" or "install certificate" MSI downloaded from a browser session, especially from an S3 bucket.
- Unexpected changes to ssh or sshd binaries on Linux servers, and new local accounts hidden from the Windows logon screen.
- New LSA security packages registered on Windows hosts.
- A TLS certificate with SHA-1 fingerprint 760be920fad07881b8ce9d94e074a35b4f806717, which Check Point says was reused across SilentDelivery and OceanGate C2 servers.
Check Point's report carries the full hash and network indicator list. The bigger takeaway is the model: when several named groups draw on one supplier's evolving toolkit, tracking the tools can reveal connections that tracking each group's name would miss.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.