Check Point Research has linked three previously distinct cyber-espionage clusters across Europe, Asia and Latin America through a shared malware ecosystem called Sparrow, pointing to a possible Chinese malware supplier behind the activity. The year-long investigation identified attacks against telecommunications providers, government agencies, military organizations, research institutions and critical infrastructure in 21 countries, according to the Check Point report.
Researchers track the three operations as SilentDelivery, OceanGate and DarkWire, and the suspected developer or supplier as CopperDragon. Check Point describes CopperDragon as a possible “digital quartermaster” supporting China-nexus actors including FamousSparrow, Earth Estries, TropicTrooper and UAT-9244. The assessment is not a definitive attribution: shared malware and command-and-control infrastructure can indicate tool access or supplier relationships without proving that the same operator conducted every intrusion.
SilentDelivery, active since early 2026, used compromised government, shipping, information-technology and research websites in highly selective watering-hole attacks. Victims saw a fake Chrome certificate warning and were urged to install a “Certificate Fix” utility that delivered the previously undocumented SquadC backdoor or a SparrowDoor variant. Check Point observed targeting in countries and territories including the Czech Republic, Germany, France, Taiwan, Nepal, Hong Kong and Indonesia, with spear-phishing also used in some cases.
OceanGate, observed during 2025 and 2026, began by compromising an internet-facing Linux server and installing the AnnobinDoor and SparrowShell backdoors. The operators then replaced legitimate SSH and SSHD components with credential-stealing versions, attempted password-based RDP access to Windows systems and deployed a SparrowDoor variant after gaining an administrator account. DarkWire, active since mid-2025, initially focused on Latin American telecommunications and government entities, using CopperDoor, CopperDNS and related tools, DLL sideloading, proxy utilities and DNS tunneling for command and control.
The report does not identify a CVE, CVSS score, vendor advisory or public exploit for the vulnerable Linux server involved in OceanGate’s initial access. Check Point instead describes the weakness only as a vulnerability affecting an internet-facing system, so defenders should not infer that a particular product or patch resolves the intrusion path. The activity also used legitimate or publicly available components such as FRP, Chisel, SoftEther VPN and the JavaScript obfuscation service jsjiami.
Security teams should review the report’s indicators and hunt for injected website JavaScript, fake certificate-installation pages, suspicious CertFixer.msi files, trojanized SSH binaries, unexpected RDP password attempts, hidden administrator accounts and DLL sideloading. Monitoring raw TCP over TLS, DNS MX tunneling, unusual high-numbered ports and unauthorized LSASS access can help identify related activity. Check Point also published domain, IP-address, certificate and file-hash indicators in its technical report, which organizations can use to support endpoint, network and web-server investigations.
