Recent investigations have uncovered a sophisticated cyber espionage operation originating from China, targeting key sectors worldwide. The research, led by Check Point, identifies three distinct threat clusters—SilentDelivery, OceanGate, and DarkWire—all connected through a shared malware ecosystem known as Sparrow. These campaigns have primarily focused on telecommunications, government, military, research institutions, and critical infrastructure across regions such as Latin America, Asia, and Europe. The entity believed to be behind the Sparrow framework is dubbed CopperDragon, which appears to be a digital tool supplier for various Chinese threat actors.
Each threat cluster employs unique tactics and tools to breach their targets. SilentDelivery uses obfuscated JavaScript on compromised websites to deceive users into installing malicious software, which primarily affects sectors in countries like the Czech Republic, Germany, and Taiwan. The malware deployed includes variants like SquadC and SparrowDoor, distributed through phishing emails as well.
OceanGate operations have been observed targeting both Windows and Linux systems, deploying custom tools to gain access and extract sensitive data. This cluster utilizes backdoors to maintain a foothold, leveraging techniques like kernel-level access to evade detection.
The third cluster focuses on Latin America, predominantly affecting telecommunications operators and government entities. This phase involves newly identified backdoors, CopperDoor and CopperDNS, employing DLL sideloading and strategic placement of tools to reduce detection risks. CopperDoor operations demonstrate high operational security, with infrastructure often located close to victim organizations, aiding in blending malicious activities with legitimate network traffic.
This coordinated cyber espionage effort highlights the increasing sophistication and global reach of China-linked threat actors, necessitating enhanced vigilance and security measures for affected sectors.
