CopperDragon Sparrow Framework Targeting Global Critical Sectors

Check Point Research has identified CopperDragon as a significant digital quartermaster entity supporting multiple China-nexus threat actors, including FamousSparrow and TropicTrooper. CopperDragon manages the 'Sparrow' cross-platform framework, which encompasses a diverse suite of Windows and Linux backdoors used in three major operational clusters: SilentDelivery, OceanGate, and DarkWire.

These operations have targeted telecommunications providers, government organizations, military entities, and critical infrastructure across Europe, Asia, and Latin America. The threat actor employs sophisticated initial access vectors, including highly selective watering-hole attacks using obfuscated JavaScript and the exploitation of vulnerable internet-facing Linux servers to facilitate lateral movement into Windows environments.

The business impact is severe, focusing on long-term espionage, credential harvesting, and data exfiltration. The use of custom kernel-level rootkits (based on Reptile) and passive network interception via WinDivert drivers indicates a high level of technical proficiency aimed at evading EDR and NDR solutions. Organizations in the targeted sectors should prioritize monitoring for the specific custom loaders and lateral movement tools identified in this framework.