Not All That Glitters Is Gold Tracking CopperDragon's Sparrow Framework Around the Globe
Not All That Glitters Is Gold: Tracking CopperDragon’s Sparrow Framework Around the Globe
During a year-long investigation, Check Point Research identified three distinct operational clusters spanning Latin America, Asia, and Europe targeting telecommunications providers, government organizations, military entities, research institutions, and critical infrastructure. The clusters, SilentDelivery, OceanGate, and DarkWire, are linked through shared infrastructure features and malware code similarities within the Sparrow malware framework. We track the entity behind the Sparrow framework as CopperDragon, a potential digital quartermaster supporting China-nexus threat actors, including FamousSparrow, Earth Estries, TropicTrooper, UAT-9244, and others. 🚀
Our research uncovered several previously undocumented tools and new details about the Sparrow framework, including Windows and Linux variants, passive backdoor capabilities, and a connection to the Melofee backdoor. Each cluster employed a different toolset and different initial access techniques, including compromising internet-facing infrastructure and highly selective watering-hole attacks. The compromised websites that were used for watering hole attacks were of government, shipping, and IT and research sectors.
Check Point Research identified numerous connections between the tools and their infrastructure which linked them to the same Sparrow malware ecosystem. We track the entity behind these campaigns as CopperDragon, which may serve as a digital quartermaster supporting a number of China-nexus threat actors that use the Sparrow cross-platform malware framework for Linux and Windows. FamousSparrow is a threat actor that was first identified in 2021, whose main backdoor is SparrowDoor. Since then, multiple vendors have reported on related activity and malware variants, including CrowDoor, HemiGate, and TernDoor.
Instead, reporting pointed to several distinct actors using a shared toolset, potentially supplied by the same entity. These actors include FamousSparrow, Earth Estries, TropicTrooper, UAT-9244, and others. Based on the apparent tool-sharing, we began tracking the entity behind the Sparrow framework as CopperDragon, its possible developer and supplier.