Cybersecurity Research Revelations Highlight Global Intrusions Linked to China Nexus
In an alarming report published on November 10, Check Point Research (CPR) has unveiled findings revealing three distinct cyber intrusion clusters operating across Latin America, Asia, and Europe. These clusters have been linked through shared malware and infrastructure, pointing to a possible common supplier of sophisticated hacking tools. The report sheds light on the increasing complexity of cyber threats emanating from China and underscores the global implications of these malicious activities.
The detailed investigation, which spanned over a year, analyzed targeted campaigns against numerous high-profile organizations across the three regions. CPR identified the suspected supplier behind the attacks and the associated Sparrow framework as "CopperDragon." This terminology refers to what is believed to be a significant player in the underground network of cyber espionage.
The Intrusion Clusters Unmasked
The clusters investigated by CPR researchers have been designated as SilentDelivery, OceanGate, and DarkWire. Each of these entities has its own modus operandi, targeting specific sectors and employing various tactics to infiltrate their targets.
Starting with SilentDelivery, first detected in early 2026, this cluster has made a name for itself by compromising legitimate websites, particularly those belonging to government agencies, shipping companies, and IT or research sectors. The attackers utilized a deceptive technique whereby visitors to the compromised sites were presented with a bogus Chrome certificate warning. This manipulative tactic prompted users to install a counterfeit "Certificate Fix" utility, primarily affecting individuals in countries such as the Czech Republic, Germany, France, Taiwan, Nepal, Hong Kong, and Indonesia. Once installed, this fake utility facilitated the deployment of either the SquadC malware or a variant of SparrowDoor, granting the attackers a critical foothold within the victim’s system.
The second cluster, OceanGate, was observed primarily during 2025 and 2026, focusing its efforts on government organizations and critical infrastructure throughout Asia. The intrusion commonly commenced through an internet-facing Linux server, from which the attackers would pivot into Windows environments. This method enabled extensive credential theft, lateral movement throughout networks, and the exfiltration of confidential operational data.
DarkWire, the last of the three clusters, was first identified in mid-2025 with a primary focus on Latin American targets. However, recent activity has indicated an expansion of their operations beyond this region. DarkWire has set its sights on telecommunications providers, having successfully infiltrated at least three major entities, as well as foreign affairs and justice institutions.
Unpacking the CopperDragon Connection
CPR has characterized CopperDragon as "a potential digital quartermaster supporting China-nexus threat actors," suggesting that this entity may function as a developer and supplier for the Sparrow framework. The implications of this claim are significant, as it suggests that there is a centralized supplier orchestrating various cyber activities under Chinese influence.
Furthermore, the analysis indicated that CopperDragon is likely involved in maintaining and distributing variants of the Melofee backdoor. The report also reveals links between the Sparrow framework and another group known as FamousSparrow. First identified in 2021, FamousSparrow has garnered attention for employing the SparrowDoor backdoor, which has been associated with numerous cyber attacks. Researchers noted that other groups, such as Earth Estries, TropicTrooper, and UAT-9244, share a similar toolset, hinting that they may potentially be supplied by the same entity.
Additionally, while DarkWire did not exhibit any direct code similarities with CopperDragon’s toolset, its connection arose from shared infrastructure linked to a previously reported domain associated with FamousSparrow. This intricate web of relationships and commonalities illustrates how shared malware and infrastructure can often obscure the lines between operators and their campaigns.
As the research highlights, it is crucial to recognize that these findings provide not merely an insight into specific actors, but a basis for a more nuanced understanding of the covert operations long attributed to FamousSparrow. With the increasing interconnectedness of cybercrime, such findings emphasize the importance of vigilance and collaboration among cybersecurity researchers and organizations globally.
In a rapidly evolving digital landscape, where attacks can stem from across the globe, the discovery of these clusters serves as a stark reminder of the persistent and adaptable nature of cyber threats. As nations and organizations fortify their defenses against such intrusions, the need for robust cybersecurity measures becomes even more pronounced.