Three distinct operational clusters, identified as SilentDelivery, OceanGate, and DarkWire, target telecommunications providers, government bodies, military entities, and critical infrastructure across Latin America, Asia, and Europe. These operations are linked to the Sparrow malware framework, attributed to an entity tracked as CopperDragon, which appears to function as a digital quartermaster for multiple China-nexus threat actors. The campaigns employ varied initial access vectors, including highly selective watering-hole attacks against compromised websites in the government, shipping, and IT sectors, as well as exploitation of vulnerable internet-facing systems. The scope of the intrusion is broad, affecting dozens of high-profile organizations, with specific regional focuses for each cluster. The risk involves persistent espionage access to sensitive operational data and critical infrastructure, facilitated by a shared ecosystem of cross-platform malware and infrastructure that connects previously distinct operations into a unified threat landscape.
The SilentDelivery cluster uses obfuscated JavaScript to replace legitimate web content with fake certificate warnings, tricking users into installing Trojanized MSI packages that deploy the SquadC backdoor or SparrowDoor variants. SquadC evades analysis by checking for sandbox artifacts and requiring active browser processes, while persisting via registry modifications. The OceanGate operation begins with Linux initial access, deploying AnnobinDoor and SparrowShell for pivoting and credential theft through Trojanized SSH tools. Lateral movement to Windows environments involves RDP brute-forcing and deployment of tools like CopperAdu for administrative access, CopperList for data staging, and CopperLogger for keystroke capture. Credential theft is achieved via CopperLsa, which hooks into the authentication flow. Both clusters utilize kernel-level rootkits for hiding processes and files, while some SparrowDoor variants use packet interception drivers to create passive backdoors that rewrite traffic ports to blend with legitimate services. DarkWire deploys CopperDoor and CopperDNS as primary implants, replacing earlier backdoor families.[/subscribe_to_unlock_form]
Three distinct operational clusters, identified as SilentDelivery, OceanGate, and DarkWire, target telecommunications providers, government bodies, military entities, and critical infrastructure across Latin America, Asia, and Europe. These operations are linked to the Sparrow malware framework, attributed to an entity tracked as CopperDragon, which appears to function as a digital quartermaster for multiple China-nexus threat actors. The campaigns employ varied initial access vectors, including highly selective watering-hole attacks against compromised websites in the government, shipping, and IT sectors, as well as exploitation of vulnerable internet-facing systems. The scope of the intrusion is broad, affecting dozens of high-profile organizations, with specific regional focuses for each cluster. The risk involves persistent espionage access to sensitive operational data and critical infrastructure, facilitated by a shared ecosystem of cross-platform malware and infrastructure that connects previously distinct operations into a unified threat landscape.
The SilentDelivery cluster uses obfuscated JavaScript to replace legitimate web content with fake certificate warnings, tricking users into installing Trojanized MSI packages that deploy the SquadC backdoor or SparrowDoor variants. SquadC evades analysis by checking for sandbox artifacts and requiring active browser processes, while persisting via registry modifications. The OceanGate operation begins with Linux initial access, deploying AnnobinDoor and SparrowShell for pivoting and credential theft through Trojanized SSH tools. Lateral movement to Windows environments involves RDP brute-forcing and deployment of tools like CopperAdu for administrative access, CopperList for data staging, and CopperLogger for keystroke capture. Credential theft is achieved via CopperLsa, which hooks into the authentication flow. Both clusters utilize kernel-level rootkits for hiding processes and files, while some SparrowDoor variants use packet interception drivers to create passive backdoors that rewrite traffic ports to blend with legitimate services. DarkWire deploys CopperDoor and CopperDNS as primary implants, replacing earlier backdoor families.[emaillocker id="1283"]
The campaigns demonstrate active development and expansion, with DarkWire initially focused on Latin American telecommunications and government sectors before showing signs of broader regional reach. The shared infrastructure and code similarities across clusters indicate a coordinated supply chain supporting multiple threat actors, including FamousSparrow and Earth Estries. The use of previously undocumented tools and kernel-level evasion techniques highlights the evolving nature of the threat. Defensive implications include the need to monitor for unusual web content replacements, validate the integrity of remote access tools, and inspect kernel modules for unauthorized rootkit activity. Organizations should prioritize patching internet-facing systems and monitoring for lateral movement indicators across both Linux and Windows environments to disrupt these persistent espionage operations.
| Tactic | Technique Id | Technique | Sub-technique |
|---|---|---|---|
| Initial Access | T1189.001 | Drive-by Compromise | Drive-by Compromise |
| Initial Access | T1566.001 | Phishing | Spearphishing Attachment |
| Execution | T1059.004 | Command and Scripting Interpreter | Unix Shell |
| Execution | T1059.003 | Command and Scripting Interpreter | Windows Command Shell |
| Persistence | T1547.001 | Boot or Logon Autostart Execution | Registry Run Keys / Startup Folder |
| Persistence | T1547.005 | Boot or Logon Autostart Execution | Systemd Service |
| Defense Evasion | T1055.001 | Process Injection | Dynamic API Resolution |
| Defense Evasion | T1014 | File System Permissions and Attributes | - |
| Credential Access | T1003.001 | OS Credential Dumping | LSASS Memory |
| Lateral Movement | T1021.006 | Remote Services | Windows Admin Shares |
| Collection | T1056.001 | Input Capture | Keylogging |
| Command and Control | T1071.001 | Application Layer Protocol | Web Protocols |
The following reports contain further technical details:
[/emaillocker]