Three espionage campaigns that were thought to be separate operations have been linked through a single malware framework, according to new research from Check Point. The campaigns targeted telecoms providers, government bodies, military organisations, research institutions and critical infrastructure across Latin America, Asia and Europe over the past year.

Check Point Research is tracking the three clusters under the names SilentDelivery, OceanGate and DarkWire. Although each used different tools and different ways of breaking in, the researchers found shared infrastructure and similarities in the malware code that connect them all to a malware ecosystem called Sparrow.

Who is behind the Sparrow framework

The entity behind the Sparrow framework has been codenamed CopperDragon. Check Point assesses that it acts as a digital quartermaster, developing and supplying tools for China-nexus threat actors including FamousSparrow, Earth Estries, Tropic Trooper, UAT-9244 and UAT-8302.

FamousSparrow was first identified in 2021, and its main backdoor is SparrowDoor. Check Point notes that FamousSparrow has previously been linked to Salt Typhoon, but says the precise nature of that relationship remains unclear. The attribution of the Sparrow framework to China-nexus actors is an assessment by the researchers, not a confirmed fact.

SilentDelivery: fake certificate warnings in Europe and Asia

SilentDelivery began in early 2026 and uses highly selective watering-hole attacks, in which attackers compromise legitimate websites visited by their intended targets. Visitors were shown a fake Google Chrome SSL certificate warning telling them to install a “Certificate Fix” utility to restore access. The utility delivered a previously undocumented backdoor called SquadC, or in some cases a SparrowDoor variant.

The compromised websites were linked to government, shipping, IT and research organisations in the Czech Republic, Germany, France, Taiwan, Nepal, Hong Kong and Indonesia. A separate report by Positive Technologies in August 2026 indicated the campaign had also targeted entities in Egypt and the Philippines. SquadC is a Windows backdoor written in C and C++ that gives operators basic remote control of an infected machine and hides itself by posing as a Windows update assistant in the registry.

OceanGate: from Linux servers to Windows networks

OceanGate, active during 2025 and 2026, focuses mainly on Asian organisations. The attackers first broke into internet-facing Linux servers, then deployed two new backdoors, AnnobinDoor and SparrowShell, before moving sideways into Windows systems.

Once inside, the attackers harvested credentials, stole data and deployed a set of custom Windows tools, including CopperAdu for remote administration, CopperList for reconnaissance, CopperLogger, a keylogger that also watches clipboard activity, and CopperLsa, which collects passwords, hashes and authentication tokens. Check Point also found kernel rootkits and kernel-level access built into SparrowDoor and SparrowShell, letting the backdoor hide its traffic by intercepting network packets.

DarkWire: telecoms and government in Latin America

DarkWire, active since mid-2025, targets telecoms providers and government organisations across Latin America. It uses two newly identified backdoors, CopperDoor and CopperDNS, the second of which communicates through DNS tunnelling using MX queries.

The operation relies heavily on DLL sideloading, in which a legitimate program is tricked into loading a malicious library, and the operators placed their tools inside existing system paths rather than creating new folders, to keep a low profile. Check Point also found that the CopperDoor infrastructure showed a higher level of operational security, with most IP addresses located in Latin America, often in the same country as the victim, which likely helps the malicious traffic blend in with normal network activity.

What the findings mean

The research shows that what looked like three unrelated campaigns were in fact supplied by one shared toolmaker. Organisations in the telecoms, government, research and critical infrastructure sectors should check for the indicators in Check Point’s report and review whether internet-facing systems and watering-hole exposure could have given the attackers a way in.