[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$flxOb3NVu9dRg0CRENQxdN7QMTogxmL07BShswzuwELs":3},{"article":4,"iocs":47,"watch_terms":67,"solutions":68,"lesson":163},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"5b7b622b-0765-4217-80c7-6437ed0604d2","Not All That Glitters Is Gold: Tracking CopperDragon’s Sparrow Framework Around the Globe","not-all-that-glitters-is-gold-tracking-copperdragon-s-sparrow-framework-around-t-1bb925","Key Points Introduction Over the past year, Check Point Research investigated a series of intrusion campaigns targeting several dozens of high-profile organizations across Latin America, Asia, and Europe. These campaigns initially appeared to be independent operations, each using different backdoors, post-exploitation tools and operational pace. However, we identified numerous connections between the tools and their […] The post Not All That Glitters Is Gold: Tracking CopperDragon’s Sparrow Framework Around the Globe appeared first on Check Point Research.","Check Point Research identified CopperDragon, a potential digital quartermaster behind the Sparrow malware framework, operating three distinct attack clusters (SilentDelivery, OceanGate, DarkWire) across Latin America, Asia, and Europe targeting telecom, government, military, and critical infrastructure. The clusters share infrastructure features and malware code similarities, and CopperDragon likely supplies multiple China-nexus threat actors including FamousSparrow, Earth Estries, TropicTrooper, and UAT-9244. The investigation uncovered previously undocumented tools and new details about Windows and Linux variants of Sparrow, passive backdoor capabilities, and connections to the Melofee backdoor.","Check Point tracks CopperDragon as likely Sparrow framework developer supplying China-nexus threat actors.","https:\u002F\u002Fresearch.checkpoint.com\u002F2026\u002Fnot-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe\u002F","https:\u002F\u002Fresearch.checkpoint.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002FGenerated-image-3-1024x512.png","2026-11-10T14:01:14+00:00","2026-11-10T15:00:31.899453+00:00",9,[17,20,22,24,26,28],{"name":18,"type":19},"CopperDragon","threat_actor",{"name":21,"type":19},"FamousSparrow",{"name":23,"type":19},"Earth Estries",{"name":25,"type":19},"TropicTrooper",{"name":27,"type":19},"UAT-9244",{"name":29,"type":30},"SilentDelivery","campaign","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":31,"icon":33,"name":34,"slug":35},null,"Threat Intelligence","threat-intelligence",[37,42],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":43},{"id":44,"icon":33,"name":45,"slug":46},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",[48,51,54,57,60,62,64],{"type":46,"value":49,"context":50},"Sparrow","Cross-platform malware framework for Windows and Linux used by multiple China-nexus threat actors",{"type":46,"value":52,"context":53},"SparrowDoor","Main backdoor associated with FamousSparrow threat actor",{"type":46,"value":55,"context":56},"SquadC","Backdoor distributed through Trojanized MSI installers by SilentDelivery cluster",{"type":46,"value":58,"context":59},"CrowDoor","Malware variant related to Sparrow framework",{"type":46,"value":61,"context":59},"HemiGate",{"type":46,"value":63,"context":59},"TernDoor",{"type":46,"value":65,"context":66},"Melofee","Backdoor connected to Sparrow framework",[],{"controls":69,"vendors":156},[70,99,128],{"slug":71,"name":72,"problem":73,"products":74},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[75,83,91],{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":87,"product_name":88,"url":89,"description":90},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":95,"product_name":96,"url":97,"description":98},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"slug":100,"name":101,"problem":102,"products":103},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[104,112,120],{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":116,"product_name":117,"url":118,"description":119},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-network","Darktrace \u002F NETWORK","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Fhybrid-network","Network detection and response based on learning normal behaviour.",{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":124,"product_name":125,"url":126,"description":127},"corelight","Corelight","\u002Fvendor-logos\u002Fcorelight.png","open-ndr","Corelight Open NDR","https:\u002F\u002Fcorelight.com\u002Fplatform\u002F","Network detection and response based on Zeek and Suricata.",{"slug":35,"name":129,"problem":130,"products":131},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[132,140,148],{"vendor_slug":133,"vendor_name":134,"vendor_logo":135,"product_slug":136,"product_name":137,"url":138,"description":139},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","google-threat-intelligence","Google Threat Intelligence","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fthreat-intelligence","Threat intelligence from Mandiant's frontline investigations, Google's threat analysts, open sources and Google's own visibility, in one service.",{"vendor_slug":141,"vendor_name":142,"vendor_logo":143,"product_slug":144,"product_name":145,"url":146,"description":147},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","recorded-future-cyber-operations","Recorded Future Cyber Operations","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fcyber-operations","Threat intelligence built into security operations workflows, to prioritise alerts and act on threats before they arrive.",{"vendor_slug":149,"vendor_name":150,"vendor_logo":151,"product_slug":152,"product_name":153,"url":154,"description":155},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","dataminr-threat-intelligence","Dataminr Threat Intelligence","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fthreat-intelligence\u002F","Real-time alerts on emerging cyber threats, exploited vulnerabilities and attacks relevant to your organisation, detected with AI across a large set of public data sources.",[157],{"slug":158,"name":159,"logo_path":160,"roles":161},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png",[162],"reported_by",{"slug":164,"title":165,"body":166,"framework_refs":167,"framework_notes":173},"copperdragons-sparrow-framework-when-a-malware-supplier-powers-multiple-nation-state-actors","CopperDragon's Sparrow Framework: When a Malware Supplier Powers Multiple Nation-State Actors","CopperDragon operates as a digital quartermaster, supplying the Sparrow malware framework and supporting infrastructure to multiple China-nexus threat actors targeting telecom, government, military, and critical infrastructure across three continents. This supply-chain model of cyber operations means that a single tooling provider enables a wide range of intrusions, making attribution harder and amplifying the reach of any single actor's capabilities. The use of passive backdoors and previously undocumented tools further indicates that defenders were failing to detect long-term persistent access across affected networks. The shared infrastructure and code similarities across clusters highlight that threat intelligence sharing and cross-organizational detection are essential — what one victim sees may be the key to uncovering attacks on others. Organizations in targeted sectors must assume that advanced persistent threat groups have access to mature, supplier-backed toolkits specifically engineered to evade standard defenses.",[168,169,170,171,172],"MITRE ATT&CK T1587.001: Develop Capabilities: Malware","NIST CSF 2.0 DE.CM-01: Networks and network services are monitored to find potentially adverse events","NIS2 Article 21(2)(d)","CIS Control 7: Continuous Vulnerability Management (v8)","NIST SP 800-53 SI-3: Malicious Code Protection",{"NIS2 Article 21(2)(d)":174,"NIST SP 800-53 SI-3: Malicious Code Protection":175,"MITRE ATT&CK T1587.001: Develop Capabilities: Malware":176,"CIS Control 7: Continuous Vulnerability Management (v8)":177,"NIST CSF 2.0 DE.CM-01: Networks and network services are monitored to find potentially adverse events":178},"CopperDragon's quartermaster model represents a supply chain threat, and this NIS2 point explicitly requires organizations to manage cybersecurity risks in their supply chains and third-party relationships.","The Sparrow framework's Windows and Linux variants and passive backdoor capabilities would need to be detected by malicious code protection mechanisms that this control requires organizations to deploy and maintain.","CopperDragon acts as a malware developer and supplier, creating the Sparrow framework and associated tools specifically to equip multiple threat actor groups — exactly the adversary capability development behavior this technique describes.","The deployment of previously undocumented tools and new malware variants against critical infrastructure underscores the need for continuous vulnerability and threat assessment to stay ahead of novel attacker capabilities.","The passive backdoors and covert C2 channels used by Sparrow clusters would require continuous network monitoring to detect, which this category directly mandates."]