Three separate espionage campaigns targeting governments, telecoms and critical infrastructure across 21 countries have been traced back to a single suspected supplier of hacking tools, according to new research from Check Point.

Check Point Research published its findings on 10 November 2026 in a report titled "Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe". The report tracks an entity it calls CopperDragon as the possible developer and supplier of the Sparrow malware framework, which runs on both Windows and Linux, and describes it as a "digital quartermaster" supporting China-linked threat actors.

The year-long investigation covered several dozen high-profile organisations in Latin America, Asia and Europe. Rather than treating the activity as one centrally run campaign, Check Point believes CopperDragon may develop or supply tools and infrastructure to several separate China-associated espionage groups, including FamousSparrow, Earth Estries, Tropic Trooper and UAT-9244.

Three clusters, one shared toolkit

Check Point divided the observed activity into three clusters based on their targets, geography and methods. The first, tracked as SilentDelivery, has been active since early 2026 and uses watering-hole attacks in Europe and Asia. It compromises legitimate websites, mainly in the government, shipping and IT or research sectors, so that visitors to those trusted sites are exposed to malware. Victims are served a backdoor called SquadC, also known as SquawkDoor, hidden inside trojanised MSI installers posing as certificate repair utilities. A spear-phishing archive delivering the same backdoor through a shortcut file has also been observed.

The second cluster, OceanGate, ran through 2025 and 2026 and mainly targeted government organisations and critical infrastructure in Asia. Its operators break into internet-facing Linux servers, then move sideways into Windows environments, deploying a variant of the SparrowDoor backdoor alongside two newly identified backdoors Check Point named CopperDoor and CopperDNS. The cluster also uses a Go-based backdoor called AnnobinDoor and a modular tool known as SparrowShell. Check Point assesses that CopperDragon also helps maintain and supply variants of the Melofee backdoor.

The third cluster, DarkWire, surfaced in mid-2025 and targets telecoms providers and government organisations across Latin America, including at least three major regional telecoms operators and foreign affairs and justice agencies. It uses the CopperDoor and CopperDNS backdoors. Research by ESET into the same implant, which it calls SparroWocky, found about 90 percent of its targets in Latin America. Check Point said it did not identify direct code similarities between DarkWire and the CopperDragon toolset, so the link there rests on shared infrastructure rather than shared code.

A familiar name at the centre

At the centre of the framework sits FamousSparrow, a threat actor first identified in 2021 and best known for its SparrowDoor backdoor and its variants Crowdoor and TernDoor. Cisco Talos has assessed with high confidence that UAT-9244 overlaps with FamousSparrow and Tropic Trooper, and that its TernDoor implant derives from CrowDoor. Check Point said the link between FamousSparrow and Salt Typhoon, the group blamed for breaching United States broadband providers, remains unclear.

Check Point published 158 indicators from the investigation, covering 51 file hashes, 14 domains and 93 IP addresses, so defenders can hunt for the activity on their own networks. The report also draws on earlier work by ESET, Positive Technologies and Cisco Talos, which documented parts of the same ecosystem under different names.

An assessment, not a proven organisation

The researchers are careful about what the evidence does and does not prove. The proposed supplier model is a research assessment rather than an independently established organisational structure, and Check Point has not established that every intrusion was conducted by the same operators. Shared malware and infrastructure can show that groups draw on the same supplier without proving they work together or take orders from the same place.

Even with that caution, the findings matter for defenders. A shared supplier means a single toolkit can appear in unrelated intrusions on different continents, and patching one group's entry point does not remove the tools they all draw on. Organisations in telecoms, government, research and critical infrastructure should check the published indicators, review internet-facing Linux servers, and treat unexpected certificate repair installers and shortcut files with suspicion.