Threats · 1 day ago
Check Point Research says its investigation over the past year linked intrusions at several dozen organizations across Latin America, Asia and Europe to the Sparrow malware ecosystem and possible supplier CopperDragon. The targets included telecommunications providers, government organizations and military entities.
The intrusions used different backdoors, other tools and operating tempos, but shared tools and infrastructure connected them. Check Point proposes CopperDragon may develop or supply Sparrow tools to several China-nexus groups; that link does not show one team ran every intrusion. A newly tracked operation, SilentDelivery, uses compromised websites and a fake, localized Chrome certificate warning to prompt visitors to install a “Certificate Fix” utility that deploys a previously undocumented backdoor.
For organizations in the reported sectors and regions, a shared supplier could connect intrusions that look unrelated without making them one campaign. The research does not establish which groups CopperDragon supports or who directed each operation.
3 sources covering this story
Suspected Chinese Malware Supplier Tied to Three Hacking Campaigns
Check Point links three China-nexus clusters through a shared Sparrow malware framework
Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem
Check Point links three espionage clusters to the Sparrow malware ecosystem, targeting telecom, government, and other sectors across three continents.
Key Points Introduction Over the past year, Check Point Research investigated a series of intrusion campaigns targeting several dozens of high-profile organizations across Latin America, Asia, and Europe.
Part of the PlainSec briefing for 2026-11-11