Check Point Research has identified three distinct operational clusters linked to the Sparrow malware framework: SilentDelivery, OceanGate, and DarkWire. These clusters are associated with the entity CopperDragon, which supports China-nexus threat actors.
The SilentDelivery cluster is known for using selective watering-hole attacks to distribute the SquadC backdoor. These attacks involved compromising legitimate websites and replacing content with a fake SSL certificate warning, which instructed users to install a 'Certificate Fix' utility. This utility deployed either the SquadC backdoor or a variant of SparrowDoor.
OceanGate primarily targets Asian organizations and utilizes a variant of SparrowDoor. Meanwhile, DarkWire focuses on telecommunications providers and government organizations across Latin America, employing CopperDoor and CopperDNS as its main backdoors.
The operations have primarily targeted organizations in countries such as the Czech Republic, Germany, France, Taiwan, Nepal, Hong Kong, and Indonesia. The JavaScript used in these attacks was heavily obfuscated and checked for the user's operating system before executing the attack.
Check Point Research's investigation revealed connections between various tools and infrastructure used in the campaigns linked to the Sparrow malware ecosystem. The exploitation status of these operations is confirmed.