[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fQDGn1Zxxey2Cnko8gdaWqyaFrW7MtWpBjUpHJOj3AUQ":3},{"article":4,"iocs":49,"watch_terms":73,"solutions":74,"lesson":169},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"4675af8d-48ef-4f90-9788-c86d370621a6","Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem","three-china-nexus-espionage-campaigns-linked-through-sparrow-malware-ecosystem-f020d8","Three distinct threat activity clusters with shared infrastructure and malware code similarities have been observed targeting telecommunications providers, government organizations, military entities, research institutions, and critical infrastructure across Latin America, Asia, and Europe over the past year. Check Point Research is tracking the clusters under the names SilentDelivery,","Three distinct threat activity clusters, SilentDelivery, OceanGate, and DarkWire, have been linked through the Sparrow malware ecosystem, with shared infrastructure and code similarities. These campaigns, attributed to China-nexus actors codenamed CopperDragon, have targeted telecommunications providers, government organizations, military entities, research institutions, and critical infrastructure across Latin America, Asia, and Europe over the past year. Each cluster employed different initial access techniques and toolsets, including watering hole attacks and compromising internet-facing infrastructure.","Three China-nexus espionage campaigns linked by Sparrow malware ecosystem targeting global entities.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F11\u002Fthree-china-nexus-espionage-campaigns.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEhJzh3KQXtsNe_Hb53sMmMSiGIRHL-ybly73FQY1F-RNeFR181cAeiYkvBDi80Upvlea0WqHLNW6ydto2DhfeD3PlISviNhaTUtVBdQMziXOtKybeWLKj7O3UmmeKP0vGX5ufVBkf1dbShyphenhyphenXgawm2sMttXPfbTTDtmYxbXo7Lw0jkGXtt-E-X7W7PtNxfD-\u002Fs1600\u002Fchinese-telecom.jpg","2026-11-10T17:43:23+00:00","2026-11-10T20:00:28.224101+00:00",9,[17,20,22,24,26],{"name":18,"type":19},"CopperDragon","threat_actor",{"name":21,"type":19},"FamousSparrow",{"name":23,"type":19},"Earth Estries",{"name":25,"type":19},"Tropic Trooper",{"name":27,"type":19},"Salt Typhoon","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":28,"icon":30,"name":31,"slug":32},null,"Threat Intelligence","threat-intelligence",[34,39,44],{"category":35},{"id":36,"icon":30,"name":37,"slug":38},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":40},{"id":41,"icon":30,"name":42,"slug":43},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":45},{"id":46,"icon":30,"name":47,"slug":48},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",[50,53,56,58,61,64,67,70],{"type":48,"value":51,"context":52},"SparrowDoor","Backdoor deployed by FamousSparrow",{"type":48,"value":54,"context":55},"Crowdoor","Variant of SparrowDoor",{"type":48,"value":57,"context":55},"TernDoor",{"type":48,"value":59,"context":60},"SparroWocky","Malware deployed by FamousSparrow and DarkWire",{"type":48,"value":62,"context":63},"HemiGate","Malware deployed by FamousSparrow",{"type":48,"value":65,"context":66},"SquadC","Backdoor distributed by SilentDelivery (aka SquawkDoor)",{"type":48,"value":68,"context":69},"SquawkDoor","Alias for SquadC backdoor",{"type":48,"value":71,"context":72},"CopperDoor","Backdoor used by DarkWire (aka SparroWocky)",[],{"controls":75,"vendors":162},[76,105,134],{"slug":77,"name":78,"problem":79,"products":80},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[81,89,97],{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"slug":106,"name":107,"problem":108,"products":109},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[110,118,126],{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"corelight","Corelight","\u002Fvendor-logos\u002Fcorelight.png","open-ndr","Corelight Open NDR","https:\u002F\u002Fcorelight.com\u002Fplatform\u002F","Network detection and response based on Zeek and Suricata.",{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-network","Darktrace \u002F NETWORK","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Fhybrid-network","Network detection and response based on learning normal behaviour.",{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"slug":32,"name":135,"problem":136,"products":137},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[138,146,154],{"vendor_slug":139,"vendor_name":140,"vendor_logo":141,"product_slug":142,"product_name":143,"url":144,"description":145},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","google-threat-intelligence","Google Threat Intelligence","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fthreat-intelligence","Threat intelligence from Mandiant's frontline investigations, Google's threat analysts, open sources and Google's own visibility, in one service.",{"vendor_slug":147,"vendor_name":148,"vendor_logo":149,"product_slug":150,"product_name":151,"url":152,"description":153},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","dataminr-threat-intelligence","Dataminr Threat Intelligence","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fthreat-intelligence\u002F","Real-time alerts on emerging cyber threats, exploited vulnerabilities and attacks relevant to your organisation, detected with AI across a large set of public data sources.",{"vendor_slug":155,"vendor_name":156,"vendor_logo":157,"product_slug":158,"product_name":159,"url":160,"description":161},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",[163],{"slug":164,"name":165,"logo_path":166,"roles":167},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png",[168],"reported_by",{"slug":170,"title":171,"body":172,"framework_refs":173,"framework_notes":179},"shared-malware-ecosystem-links-three-china-nexus-espionage-campaigns-against-critical-sectors","Shared Malware Ecosystem Links Three China-Nexus Espionage Campaigns Against Critical Sectors","Three coordinated threat clusters attributed to China-nexus actors exploited internet-facing infrastructure and watering hole attacks to compromise telecommunications, government, military, and research targets across multiple continents. The campaigns were connected through shared malware code and infrastructure — a pattern that persisted undetected long enough to span a full year of activity. This highlights how advanced persistent threat (APT) actors reuse and evolve tooling across campaigns, making detection harder when defenders lack visibility into code-level and infrastructure-level similarities. The targeting of critical infrastructure sectors underscores that organizations must assume they are high-value targets and invest in proactive threat intelligence and anomaly detection. Failure to monitor for shared indicators of compromise across campaigns allows attackers to operate persistently with minimal friction.",[174,175,176,177,178],"MITRE ATT&CK T1189: Drive-by Compromise","NIST CSF 2.0 DE.CM-01: Networks and network services are monitored to find potentially adverse events","CIS Control 7: Continuous Vulnerability Management","NIS2 Article 21(2)(a)","NIST SP 800-53 SI-4: System Monitoring",{"NIS2 Article 21(2)(a)":180,"NIST SP 800-53 SI-4: System Monitoring":181,"MITRE ATT&CK T1189: Drive-by Compromise":182,"CIS Control 7: Continuous Vulnerability Management":183,"NIST CSF 2.0 DE.CM-01: Networks and network services are monitored to find potentially adverse events":184},"Risk analysis and information system security policies applied to critical infrastructure sectors — precisely those targeted here — would require organizations to systematically assess and document exposure to nation-state threats and implement commensurate controls.","SI-4 requires organizations to monitor information systems to detect attacks and indicators of potential attacks, which would have surfaced the shared Sparrow malware ecosystem infrastructure used persistently across all three clusters.","The watering hole attacks used in these campaigns represent Drive-by Compromise, where victims are infected simply by visiting a legitimate but attacker-controlled website — understanding this technique is essential to defending against initial access in this incident.","The attackers exploited internet-facing infrastructure as an initial access vector, which continuous vulnerability scanning and timely remediation of exposed systems would have directly reduced.","Continuous network monitoring would have enabled defenders to detect shared C2 infrastructure and anomalous outbound traffic patterns linking the three clusters before a year of undetected activity elapsed."]