CopperDragon may supply tools across separate espionage groups
Check Point Research says its investigation over the past year linked intrusions at several dozen organizations across Latin America, Asia and Europe to the Sparrow malware ecosystem and possible supplier CopperDragon. The targets included telecommunications providers, government organizations and military entities.
The intrusions used different backdoors, other tools and operating tempos, but shared tools and infrastructure connected them. Check Point proposes CopperDragon may develop or supply Sparrow tools to several China-nexus groups; that link does not show one team ran every intrusion. A newly tracked operation, SilentDelivery, uses compromised websites and a fake, localized Chrome certificate warning to prompt visitors to install a “Certificate Fix” utility that deploys a previously undocumented backdoor.
For organizations in the reported sectors and regions, a shared supplier could connect intrusions that look unrelated without making them one campaign. The research does not establish which groups CopperDragon supports or who directed each operation.
Not All That Glitters Is Gold: Tracking CopperDragon’s Sparrow Framework Around the Globe - Check Point Research
Key Points Introduction Over the past year, Check Point Research investigated a series of intrusion campaigns targeting several dozens of high-profile organizations across Latin America, Asia, and Europe.