CopperDragon Sparrow Framework: SilentDelivery, OceanGate and DarkWire Campaigns (China-nexus)

Key facts

Detection coverage

As of 2026-11-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5652 across Splunk SPL, Microsoft KQL and Sigma, covering 32 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: CopperDragon SilentDelivery - ftp.exe LOLBin Script Execution and CertFixer.msi Install (Exploitation)

Detects the SilentDelivery initial-access chain described for TL-2026-5652: a spear-phishing .docx.lnk that abuses ftp.exe (-s: script mode) as a LOLBin to run a batch script, shells spawned by ftp.exe, msiexec installing the fake-certificate lure CertFixer.msi, the Strategi_AS_Referensi_April2026 lure name, and the known CertFixer.msi SHA-256. These behaviours precede deployment of the SquadC backdoor and loader.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1566.001, T1204.002, T1202, T1059.003
• Data sources: sysmon, microsoft_defender_for_endpoint
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h ((Image="*\\ftp.exe" CommandLine="* -s:*") OR (ParentImage="*\\ftp.exe" (Image="*\\cmd.exe" OR Image="*\\powershell.exe")) OR (Image="*\\msiexec.exe" CommandLine="*CertFixer*") OR CommandLine="*Strategi_AS_Referensi_April2026*" OR Hashes="*715c206629f59ff5b0134a33362162ce7a40a9b25aa17f0543dc9648d51a67cf*") | eval indicator=case(like(Image,"%ftp.exe"),"ftp.exe LOLBin script execution (SilentDelivery LNK lure)",like(ParentImage,"%ftp.exe"),"Shell spawned by ftp.exe",like(CommandLine,"%CertFixer%"),"CertFixer.msi installation (fake certificate lure)",true(),"Known TL-2026-5652 lure artifact") | stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_lines values(ParentImage) as parent_images by host, User, Image, indicator | convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where (FileName =~ 'ftp.exe' and ProcessCommandLine has ' -s:')
    or (InitiatingProcessFileName =~ 'ftp.exe' and FileName in~ ('cmd.exe', 'powershell.exe'))
    or (FileName =~ 'msiexec.exe' and ProcessCommandLine has 'CertFixer')
    or ProcessCommandLine has 'Strategi_AS_Referensi_April2026'
    or SHA256 =~ '715c206629f59ff5b0134a33362162ce7a40a9b25aa17f0543dc9648d51a67cf'
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
| sort by Timestamp desc

Sigma

title: CopperDragon SilentDelivery ftp.exe LOLBin Script Execution and CertFixer.msi Install
id: 3f1d2a64-8b7e-4c19-a5d2-5652a1000001
status: experimental
description: Detects ftp.exe abused with -s: to run a script (SilentDelivery LNK lure), shells spawned by ftp.exe, and msiexec installing the CertFixer.msi fake certificate lure.
references:
    - https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/
author: Threadlinqs Team
date: 2026/11/10
tags:
    - attack.initial_access
    - attack.t1566.001
    - attack.execution
    - attack.t1204.002
    - attack.t1059.003
    - attack.defense_evasion
    - attack.t1202
logsource:
    category: process_creation
    product: windows
detection:
    selection_ftp:
        Image|endswith: '\ftp.exe'
        CommandLine|contains: ' -s:'
    selection_ftp_child:
        ParentImage|endswith: '\ftp.exe'
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
    selection_msi:
        Image|endswith: '\msiexec.exe'
        CommandLine|contains: 'CertFixer'
    selection_lure:
        CommandLine|contains: 'Strategi_AS_Referensi_April2026'
    selection_hash:
        Hashes|contains: '715c206629f59ff5b0134a33362162ce7a40a9b25aa17f0543dc9648d51a67cf'
    condition: 1 of selection_*
falsepositives:
    - Administrators using ftp.exe -s: for scripted file transfers
    - Legitimate software packages that happen to be named with CertFixer
level: high

Known false positives:

• Administrators or legacy batch jobs that use ftp.exe -s: for scripted FTP transfers
• Software deployment tooling that runs msiexec with a package named CertFixer

Tuning notes: Exclude known automation hosts and service accounts that legitimately script ftp.exe. If your Sysmon index is not named sysmon, adjust the index. Add further lure filenames from new reporting; the ftp.exe -s: leg is the durable behavioural signal.

• 🔒 CopperDragon SilentDelivery - Fake Certificate Watering-Hole URL Pattern and CertFixer.msi Delivery (Exploitation) · unlock with TL Creds
• 🔒 CopperDragon DarkWire - CopperLsass/CopperLsa LSASS Credential Theft and LSA Security Package Abuse (Post-Exploitation) · unlock with TL Creds
• 🔒 CopperDragon - Outbound Connections to Known C2 Infrastructure and CopperDNS Port 6532 (C2) · unlock with TL Creds
• 🔒 CopperDragon OceanGate - Linux Web Service Spawning Shell, AnnobinDoor/SparrowShell Implants and Reptile Rootkit Load (Exploitation) · unlock with TL Creds
• 🔒 CopperDragon DarkWire - CopperLoader DLL Side-Loading Pairs Outside Program Files (Defense Evasion) · unlock with TL Creds
• 🔒 CopperDragon - Impacket wmiexec ADMIN$ Lateral Movement and Hidden admin$ Account Creation (Lateral Movement) · unlock with TL Creds
• 🔒 CopperDragon - [indicator] Run Key, Hidden admin$ Account and RasiUwpApp/ss1 Firewall Rules (Post-Exploitation) · unlock with TL Creds
• 🔒 CopperDragon DarkWire - CopperDNS MX Query Tunneling and Known C2 Domain Lookups (C2) · unlock with TL Creds

Indicators of compromise

As of 2026-11-10, Threadlinqs Intelligence tracks 32 indicators of compromise for TL-2026-5652.

Sample indicators (3 of 32)

• IP address: 135.136.135[.]54
• Domain: microsfot[.]vip
• File hash: 715c206629f59ff5b0134a33362162ce7a40a9b25aa17f0543dc9648d51a67cf

Defanged, TLP:CLEAR. Full set of 32 indicators: unlock with TL Creds.

Technical analysis

CopperDragon is a Check Point Research-tracked entity assessed as a possible developer and/or supplier of the Sparrow framework (Windows and Linux) to several China-nexus actors, including FamousSparrow, Earth Estries, TropicTrooper and UAT-9244. The authors caution that shared malware and infrastructure do not necessarily mean two intrusions were run by the same actor, given the interconnected China-nexus ecosystem.

SilentDelivery (2026): legitimate government, shipping and IT/research websites (one via an XSS on an unsanitized input field) were compromised and injected with a jsjiami-obfuscated script. The script checks for Windows (sometimes the domain), polls /image-check?t=<datetime> on the C2 to fingerprint the visitor by IP/geolocation, then replaces the page with a localized fake Chrome certificate error with an 'Install certificate' button. Clicking it sends /report-url to the C2 and downloads an MSI (CertFixer.msi) from an attacker-controlled S3 bucket (three buckets identified). After execution the backdoor calls /register-ip so the lure stops appearing. The payload is SquadC, a new C/C++ Windows backdoor loaded in memory by a three-stage loader; persistence is a Run key named WindowsUpdateAssist, and anti-analysis checks VM artifacts, blacklisted MACs, screen resolution, disk size and running browsers. SquadC commands: 0x2 dir listing, 0x3 delete file, 0x4 write file, 0x5 execute with output, 0x6 systeminfo, 0x7 screenshot, 0x8 status check, 0xA background execution. A SparrowDoor variant was also seen. A spear-phishing variant used Strategi_AS_Referensi_April2026.rar containing a .docx.lnk abusing ftp.exe as a LOLBin to run a batch script (_rels/info.dll), a CAB with loader components (_rels/.rels.log) and an empty decoy PDF. Victims were observed in the Czech Republic, Germany, France, Taiwan, Nepal, Hong Kong and Indonesia. The loader DLL was previously used in the FamousSparrow toolset, and C2s share layout, exposed services, HTTP banners and a reused code-signing certificate (SHA-1 760be920fad07881b8ce9d94e074a35b4f806717, expired 2024-04-27).

OceanGate (2025-2026): an exploited internet-facing Linux server gives initial access in Asian government and critical-infrastructure networks. Linux tooling includes AnnobinDoor (UPX-packed static Go backdoor, internal name annobinagent, WebSocket/HTTP/TCP C2, shell, file management, SOCKS, SSH tunneling, port forwarding), SparrowShell (modular Linux version of SparrowDoor with RC4 keys, plugins decrypted to /tmp/%x, loaded with dlopen/xmain and deleted; command range 0x1001-0x100E, magic 0x11223344), a modified open-source Reptile rootkit (init_module, hide/show flags, ioctl 0x0e0e0e0e) sharing code with the Melofee backdoor, trojanized OpenSSH client/server for credential harvesting, and FRPC, Chisel and ASimplePortScanner. On Windows the actors guessed RDP passwords until an administrator account worked, then deployed CopperAdu (hidden admin$ account, LocalAccountTokenFilterPolicy=1, firewall rule RasiUwpApp opening TCP 445), CopperList (LZNT1-compressed file inventory), CopperLogger (Raw Input keylogger with hidden window kbl), CopperLsa (malicious LSA security package capturing NTLM/Kerberos credentials) and a SparrowDoor variant. A passive SparrowDoor embeds WinDivert drivers to intercept inbound port 443 traffic from a specific source IP and redirect it to an internal port.

DarkWire (mid-2025 onward): intrusions into at least three major Latin American telecom providers plus foreign-affairs and justice sectors, with signs of expansion beyond the region. CopperLoader (reflective position-independent shellcode in hijacked DLLs, RC4-encrypted .dat payloads, stripped MZ/PE headers) loads CopperDoor (also called SparroWocky by ESET; modular in-memory backdoor using call-stack spoofing and gadget-based execution) or CopperDNS (C2 tunneled over DNS MX queries). Supporting tools: CopperProxy (SOCKS5, up to 300 clients, firewall rule ss1), PyProxy (PyInstaller UDP relay), CopperLsass (slave.dll loaded into LSASS as a security package; comsvcs.dll/dep.dll dump, custom SUB-XOR-ADD encryption, output renamed 1.png), SoftEther VPN renamed vmtoolsd.exe/csrss.exe, and SMB/wmiexec lateral movement. DLL side-loading pairs: ncpmif32.dll/ncptrcw.exe, winfsp.dll/fsptool.exe, libvlccore.dll/vlc.exe, DukeQt.dll/gethwid.exe, zCrashReport64.dll/zCrashReport64.exe. CopperDoor C2 uses raw TCP in TLS on 443 with certificate CNs mimicking victim domains; CopperDNS C2 uses high ports (commonly 6532) and a reused certificate with CN 8.8.8.8. The domain amelicen.com, previously reported as a SparrowDoor C2 by ESET, later appeared in CopperDNS infrastructure, and ESET reported CopperDoor replacing SparrowDoor on compromised hosts.

No CVE is named; CVSS is not applicable. BeaconBeagle correlation was attempted but the service returned HTTP 502, so no C2 matches are recorded.

MITRE ATT&CK techniques by tactic:

Credential Access

T1003.001 LSASS Memory; T1056.001 Keylogging; T1110.001 Password Guessing

Defense Evasion

T1014 Rootkit; T1202 Indirect Command Execution; T1497 Virtualization/Sandbox Evasion; T1564.002 Hidden Users; T1574.001 DLL; T1620 Reflective Code Loading

Lateral Movement

T1021.001 Remote Desktop Protocol; T1021.002 SMB/Windows Admin Shares

Execution

T1059.003 Windows Command Shell; T1059.007 JavaScript; T1204.002 Malicious File

Command and Control

T1071.004 DNS; T1090 Proxy; T1572 Protocol Tunneling

Collection

T1113 Screen Capture; T1560 Archive Collected Data

Persistence

T1136.001 Local Account; T1547.001 Registry Run Keys / Startup Folder; T1547.005 Security Support Provider

Initial Access

T1190 Exploit Public-Facing Application; T1566.001 Spearphishing Attachment

defense-impairment

T1686 Disable or Modify System Firewall

Remediation

Patches

• No CVE was named in the source; patch internet-facing Linux servers and web applications to current vendor releases

Immediate actions

• Block and hunt the published domains, IPs and SHA-256 hashes across proxy, DNS, firewall and EDR telemetry
• Hunt for the WindowsUpdateAssist Run value, the hidden admin$ local account, firewall rules RasiUwpApp and ss1, and a LocalAccountTokenFilterPolicy value of 1
• Hunt Linux hosts for /tmp/%x plugin files, containerd-demo, xfs_rudp and aplk binaries, and Reptile-style hidden modules; compare OpenSSH binaries against package hashes
• Audit LSA security packages and LSASS module loads for unsigned DLLs such as slave.dll

Workarounds

• Block downloads of MSI files from untrusted S3 buckets at the proxy
• Restrict ftp.exe execution from user-writable paths and Office-style LNK lures
• Enable LSA protection (RunAsPPL) and Credential Guard

Longer-term hardening

• Deploy EDR with call-stack and in-memory shellcode detection
• Restrict RDP exposure and enforce MFA and account lockout to defeat password guessing
• Harden and monitor internet-facing Linux servers and web applications (input sanitization, WAF, integrity monitoring)
• Train users that browsers never ask to install certificates from a web page; restrict MSI execution from the web
• Monitor DNS for anomalous MX query volume and TLS certificates with CN 8.8.8.8

Affected and fixed versions

• Multiple — Windows endpoints and servers (government, shipping, IT/research, telecom)
  Vulnerable versions: Not version-specific
• Multiple — Internet-facing Linux servers and compromised websites
  Vulnerable versions: Not version-specific

Timeline

• 2024-04-27 Code-signing certificate (SHA-1 locked-ioc-10) later reused across SilentDelivery C2 infrastructure expires
• 2025-03-26 ESET publishes FamousSparrow research documenting SparrowDoor variants and C2 domain locked-ioc-27, later seen in CopperDNS infrastructure
• 2025-07-01 DarkWire intrusions against Latin American telecom providers and government begin (mid-2025 onward)
• 2025-07-16 Self-signed certificate with CN 8.8.8.8 used by DarkWire CopperDNS C2 becomes valid (valid through 2026-07-16)
• 2025-09-01 OceanGate activity against Asian government and critical infrastructure observed (2025-2026; approximate start)
• 2026-04-01 Spear-phishing RAR Strategi_AS_Referensi_April2026.rar, uploaded from Indonesia, delivers the SquadC loader chain via an ftp.exe LOLBin LNK
• 2026-07-16 CopperDNS CN 8.8.8.8 certificate validity period ends
• 2026-11-10 Check Point Research publishes tracking of CopperDragon's Sparrow framework with full IOC set

Sources cited

• NCSC Malware Analysis Report: SparrowDoor NCSC (UK) · Advisory
• Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe Check Point Research · Research · 2026-11-10
• You will always remember this as the day you finally caught FamousSparrow (ESET Research) ESET WeLiveSecurity · Research · 2025-03-26
• ESET: Cyberespionage attacks by the China-aligned FamousSparrow group in the United States eset.com · Vendor report · 2025-03-26
• CSA Research Note: FamousSparrow SparroWocky backdoor labs.cloudsecurityalliance.org · Research
• Beware the SparroWock: the backdoor that bites (ESET Research) ESET WeLiveSecurity · Research
• Chinese hackers use SparroWocky malware in govt espionage attacks (BleepingComputer) BleepingComputer · News

More in apt

• North Korean Lazarus (Operation DreamJob) and DeceptiveDevelopment Target Drone Technology and Software Supply Chains
• North Korea-aligned Lazarus Targets Drone Sector (ScoringMathTea via BinMergeLoader) and DeceptiveDevelopment Targets Software Repositories (ESET APT Activity Report Q2-Q3 2026)
• Turla (Secret Blizzard) Cereal modular .NET toolset targets government Microsoft Exchange servers
• TraderTraitor (DPRK-aligned) FLATROOF and ROOFDECK macOS Backdoors Resurface on IT Services Victim With No Crypto Ties
• CRAFTY FALCON targets Indian fintechs via exposed APIs during weekends and low-monitoring periods