security researchers have uncovered three coordinated espionage clusters—dubbed SilentDelivery, OceanGate, and DarkWire—all tied together through a shared malware ecosystem called “Sparrow.” The umbrella behind Sparrow, identified as CopperDragon, is believed to outfit multiple China-nexus threat actors with tools and infrastructure for conducting targeted attacks against telecom firms, governmental bodies, military agencies, and research institutions across Latin America, Asia, and Europe over the past year.
How the attacks unfold
The SilentDelivery campaign, active since early 2026, deploys watering hole attacks. Malicious actors inject obfuscated javascript into legitimate government, IT, shipping, and research websites across Europe and Asia. Visitors confronted with fake certificate errors are prompted to install a tool disguised as a certificate fixer—once installed, it delivers either the SquadC backdoor (aka SquawkDoor) or a SparrowDoor variant. In some cases, phishing emails targeting Indonesia use disguised shortcuts to invoke SquadC via DLL sideloading. Countries affected include Germany, France, Taiwan, Hong Kong, Indonesia, Nepal, and the Czech Republic—with reports also hinting at operations in Egypt and the Philippines.
OceanGate, active between 2025 and 2026, combines attacks on Linux and Windows environments. The chain starts with Linux backdoors—AnnobinDoor and the modular SparrowShell—used to capture credentials and gain footholds. Attackers then pivot to Windows machines using RDP brute force, planting customized tools such as CopperAdu for remote administration, CopperList for system reconnaissance, CopperLogger for keyboard and clipboard capture, and CopperLsa for obtaining authentication data. Kernel-level stealth mechanisms, like rootkits and network packet interception via Windows drivers, are manipulated to veil exfiltration and ongoing access.
Tools & tactics across regions
The DarkWire cluster specifically targets telecom operators and government agencies in Latin America. Key malware components here include CopperDoor (aka SparroWocky), CopperDNS (which hijacks DNS queries to tunnel traffic), CopperLoader for initial deployment, CopperProxy for relaying, PyProxy for lightweight UDP relaying, and CopperLsass for harvesting credentials via the LSASS process. Attackers consistently rely on DLL sideloading, avoid creating obvious footprints like new directories, and often use IPs located near victim organizations to blend in—with infrastructure often hosted within the same region.
Together, these campaigns reflect three very different intrusion paths and toolkits—but the Sparrow ecosystem links them into a single supply chain. CopperDragon is assessed to be serving as the developer and facilitator of a broad array of malware and operations, including but not limited to clusters run under code names like FamousSparrow, Earth Estries, Tropic Trooper, and UAT-9244 / UAT-8302.
Why this matters
This pattern demonstrates how modern state-aligned espionage is increasingly modular, with shared malware ecosystems enabling diverse campaigns under a unified platform. It complicates attribution—tool reuse blurs lines between distinct groups—and increases the scale of potential exposure worldwide.
Organizations in media, shipping, research, telecoms, and government should review browser warnings, installers presented through compromised web content, and unusual DLL loads, especially on servers. Endpoint detection, registry monitoring, driver usage, exfiltration via DNS tunnels—all deserve scrutiny. Understanding that Sparrow and CopperDragon form a multi-cluster network is critical to their defense.
For defenders, seeing the Sparrow ecosystem emerge signals that espionage operations are consolidating resources into tool-sharing ecosystems. Long-term, cyber defense capabilities must anticipate such ecosystems—not just isolated campaigns. Detection methods must evolve to catch evidence of shared codebases, stealthy kernel modules, and unorthodox persistence methods. When the same malware overlaps across clusters, analyzing these connections can help predict future targeting and expose attacker infrastructure before it’s too late.
