In a significant cybersecurity development, Check Point Research has identified three distinct espionage campaigns that share infrastructure and malware code similarities, targeting telecommunications, governmental, military, and critical infrastructure sectors in Latin America, Asia, and Europe. These campaigns, named SilentDelivery, OceanGate, and DarkWire, are linked through a malware ecosystem known as Sparrow.
The Role of CopperDragon
The entity responsible for the Sparrow framework is dubbed CopperDragon, believed to be developing tools for several China-nexus threat actors. Among the notable actors are FamousSparrow, Earth Estries, and Tropic Trooper. CopperDragon’s role as a digital quartermaster involves crafting specialized malware like SparrowDoor and its variations, which have been deployed in these campaigns.
Each campaign employs unique toolsets and initial access strategies, utilizing compromised infrastructure and selective watering hole attacks. Websites from sectors such as government, shipping, IT, and research have been targeted to facilitate these attacks.
SilentDelivery’s Methodology
The SilentDelivery campaign uses heavily obfuscated JavaScript injected into legitimate websites, prompting users to install a “Certificate Fix” utility. This utility delivers malware like SquadC, a Windows backdoor. This method has targeted entities in regions such as the Czech Republic, Germany, and Indonesia. Additionally, phishing emails disguised as PDF documents have been used to distribute this malware.
According to Positive Technologies, the campaign’s reach extends to Egypt and the Philippines, indicating a broad operational scope. The campaign’s sophistication is evident in its use of status-check requests to a command-and-control server, gathering user data to decide on advancing the attack.
OceanGate and DarkWire Campaigns
The OceanGate operation targets both Windows and Linux systems, employing backdoors like AnnobinDoor and SparrowShell to maintain access and exfiltrate data. The campaign involves advanced techniques, such as kernel rootkits, to evade detection and manipulate network packets.
In contrast, DarkWire focuses on Latin American telecommunications and government sectors, deploying backdoors like CopperDoor and CopperDNS. This campaign uses DLL sideloading for execution, embedding tools within existing system paths to minimize detection.
Both campaigns reflect a high level of operational security, often situating their infrastructure within the same regions as their targets, thus blending malicious traffic with legitimate network activity.
These espionage efforts underscore the growing complexity and reach of cyber threats linked to China-nexus actors. As global cybersecurity challenges evolve, vigilance and advanced threat detection remain critical in safeguarding sensitive sectors worldwide.
