Threat intel
One toolkit, three China-nexus espionage clusters
Check Point links three China-nexus espionage clusters to a shared malware supplier it calls CopperDragon. What the Sparrow framework does and how to hunt for it.
On November 10, 2026, Check Point Research published a report that ties three separate China-nexus espionage operations back to one shared source of tools. The three clusters, which Check Point calls SilentDelivery, OceanGate and DarkWire, were first tracked as unrelated because they hit different regions and sectors with different malware. What connects them is a malware family built around a framework Check Point calls Sparrow, and the developer behind it, which the firm names CopperDragon.
Check Point assesses that CopperDragon may work as a "digital quartermaster," developing or supplying malware and infrastructure to several China-nexus groups rather than running every break-in itself. That framing matters for defenders. The report cautions that shared tooling "does not necessarily mean that two intrusions were conducted by the same actor," so the clean attribution you might want is not on offer. The activity reached dozens of organizations across 21 countries in Europe, Asia and Latin America, hitting telecommunications providers, government bodies, military entities and research institutions. If you run infrastructure in those sectors or regions, this is a hunt worth starting this week.
How the Sparrow framework works
SparrowDoor is a backdoor first documented in public research on the group FamousSparrow. A backdoor is malware that gives an operator remote control of a machine after the initial break-in. The Sparrow framework is the wider set of loaders, proxies and backdoors built around it that Check Point now attributes to CopperDragon, and it runs on both Windows and Linux.
The detail defenders should read closely is a change Check Point found in some Windows versions of SparrowDoor. Those builds carry a packet-capture driver called WinDivert and use it to work at the kernel level, the most privileged layer of the operating system. Instead of opening its own listening port and waiting for connections, the backdoor becomes passive. It inspects traffic that arrives for a service already running on the host, such as the web server on TCP port 443.
The mechanism is specific. The driver's filter watches inbound traffic to port 443 from one chosen source address and rewrites the destination port to an internal high port, such as 49628, where the backdoor listens. Packets that begin with a marker value, 0x11223344, are pulled aside and treated as operator commands. Everything else is forwarded to the real service on the local machine, so the website keeps serving and nothing looks out of place. Replies have their port rewritten back, so the answer appears to come from the legitimate service.
This is why ordinary network detection struggles with it. There is no new open port to find in a scan, no fresh outbound connection to a strange address, and no beacon firing on a timer. The command channel rides inside traffic to a port you already expect to be busy, from an address the operator controls. These driver and packet-rewriting details come from Check Point's report, not from independent observation.
What the three clusters did
OceanGate is the one to understand first, because of how it moves. Check Point says the operators broke in through an internet-facing Linux server, deployed Linux backdoors it tracks as AnnobinDoor and SparrowShell, then replaced the system's SSH client and SSH daemon (SSH is the secure shell service used for remote command-line logins) with trojanized copies to harvest the credentials of everyone who logged in. With those credentials they spread to other Linux hosts, then turned to Windows. They tried passwords over the Remote Desktop Protocol (RDP, the service for remote graphical logins) until an administrator account worked, and from there installed a set of Windows tools and a SparrowDoor variant. OceanGate ran from 2025 into 2026 and focused on Asia.
SilentDelivery has run since early 2026 and used watering-hole attacks, where a site the target already visits is compromised to serve malware. Visitors saw a fake browser certificate warning pushing a "certificate fix" utility that installed a backdoor Check Point tracks as SquadC, or a SparrowDoor variant. Check Point tied the compromised sites to government, shipping, information technology and research organizations in Europe and Asia.
DarkWire surfaced in mid-2025 against telecommunications providers and government bodies, mostly in Latin America, using backdoors Check Point tracks as CopperDoor and CopperDNS, the second of which tunnels its command traffic inside DNS (domain name system) lookups. The report links the wider Sparrow ecosystem to known China-nexus actors FamousSparrow, Earth Estries, Tropic Trooper and UAT-9244.
The Linux-first pattern should change where you look. Many teams watch Windows closely with endpoint detection and response (EDR, software that records and flags suspicious activity on a device) and treat Linux servers as quiet appliances. Here the credential theft and the first foothold happened on Linux, and the Windows estate was reached second, from the inside, where perimeter controls do not help.
What to do
Pull the indicators of compromise and hunt. The Check Point report publishes indicators of compromise, the file hashes, domains and network addresses tied to the known activity, usually shortened to IOCs. Run them against your endpoint, DNS and web proxy logs back to at least mid-2025, since the oldest cluster, DarkWire, dates to then.
Watch for suspicious kernel drivers. Alert on drivers loading from unusual paths, drivers that are not signed, and the WinDivert driver appearing on a server that has no reason to capture packets. This is also the moment to watch for bring-your-own-vulnerable-driver behaviour, known as BYOVD, where an attacker loads a legitimately signed but flawed driver to reach the kernel. A good EDR can report every driver loaded and who loaded it.
Monitor Linux for credential theft and lateral movement. Check the integrity of the sshd and ssh binaries and the libraries they load, and alert on unexpected changes to them. Then alert on any login from a Linux server into a Windows host over RDP, a direction that is rarely legitimate and was central to how OceanGate crossed over.
Segment the management networks. Telecommunications and government management planes should not be reachable flat from a general corporate network. Putting the Linux servers that run them behind their own controls limits how far a single stolen credential travels.
Prioritise by sector and region. If you are a telecommunications provider, a government or military body, or a research institution in Europe, Asia or Latin America, treat this as current and specific, not background noise.
The shared-toolkit problem
The value of CopperDragon's framework to the groups that use it is that it blurs attribution. The same backdoor turning up in two countries no longer points to one team. For a defender, that shifts the useful question from "who is this" to "do I see this tooling," and the second question has an answer. The passive backdoor, the trojanized SSH binaries and the published IOCs are concrete things to look for, whoever is at the keyboard.
If you operate in one of the targeted sectors and want a second set of eyes on where a Linux foothold could pivot into your Windows estate, our security operations team runs this kind of threat hunt, and our network penetration testing work tests whether that Linux-to-Windows path is open before someone else finds it. Open the chat and Yaali, our AI agent, will pass your question to the engineer who would do the work.
Sources: Check Point Research, Check Point Blog, The Hacker News.