# CopperDragon Sparrow Framework: SilentDelivery, OceanGate and DarkWire Campaigns (China-nexus)

> Check Point Research tracks CopperDragon, a possible developer/supplier of the cross-platform Sparrow framework used by China-nexus actors (linked to FamousSparrow, Earth Estries, TropicTrooper, UAT-9244). Three clusters are described: SilentDelivery (watering-hole 'Certificate Fix' MSI delivering the new SquadC backdoor against government, shipping and IT/research targets in Europe and Asia), OceanGate (Linux server compromise leading to domain-level compromise in Asian government/critical infrastructure) and DarkWire (telecom and government intrusions in Latin America).

- **Published:** 2026-11-10T14:19:25Z
- **Last reviewed:** 2026-11-10T14:19:25Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5652
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5652.png
- **ID:** TL-2026-5652
- **Severity:** HIGH
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** CopperDragon (China)
- **Detections:** 9 (1 shown free below) · **IOCs:** 32 (3 shown free below)

## Description

CopperDragon is a Check Point Research-tracked entity assessed as a possible developer and/or supplier of the Sparrow framework (Windows and Linux) to several China-nexus actors, including FamousSparrow, Earth Estries, TropicTrooper and UAT-9244. The authors caution that shared malware and infrastructure do not necessarily mean two intrusions were run by the same actor, given the interconnected China-nexus ecosystem.

SilentDelivery (2026): legitimate government, shipping and IT/research websites (one via an XSS on an unsanitized input field) were compromised and injected with a jsjiami-obfuscated script. The script checks for Windows (sometimes the domain), polls /image-check?t=<datetime> on the C2 to fingerprint the visitor by IP/geolocation, then replaces the page with a localized fake Chrome certificate error with an 'Install certificate' button. Clicking it sends /report-url to the C2 and downloads an MSI (CertFixer.msi) from an attacker-controlled S3 bucket (three buckets identified). After execution the backdoor calls /register-ip so the lure stops appearing. The payload is SquadC, a new C/C++ Windows backdoor loaded in memory by a three-stage loader; persistence is a Run key named WindowsUpdateAssist, and anti-analysis checks VM artifacts, blacklisted MACs, screen resolution, disk size and running browsers. SquadC commands: 0x2 dir listing, 0x3 delete file, 0x4 write file, 0x5 execute with output, 0x6 systeminfo, 0x7 screenshot, 0x8 status check, 0xA background execution. A SparrowDoor variant was also seen. A spear-phishing variant used Strategi_AS_Referensi_April2026.rar containing a .docx.lnk abusing ftp.exe as a LOLBin to run a batch script (_rels/info.dll), a CAB with loader components (_rels/.rels.log) and an empty decoy PDF. Victims were observed in the Czech Republic, Germany, France, Taiwan, Nepal, Hong Kong and Indonesia. The loader DLL was previously used in the FamousSparrow toolset, and C2s share layout, exposed services, HTTP banners and a reused code-signing certificate (SHA-1 760be920fad07881b8ce9d94e074a35b4f806717, expired 2024-04-27).

OceanGate (2025-2026): an exploited internet-facing Linux server gives initial access in Asian government and critical-infrastructure networks. Linux tooling includes AnnobinDoor (UPX-packed static Go backdoor, internal name annobinagent, WebSocket/HTTP/TCP C2, shell, file management, SOCKS, SSH tunneling, port forwarding), SparrowShell (modular Linux version of SparrowDoor with RC4 keys, plugins decrypted to /tmp/%x, loaded with dlopen/xmain and deleted; command range 0x1001-0x100E, magic 0x11223344), a modified open-source Reptile rootkit (init_module, hide/show flags, ioctl 0x0e0e0e0e) sharing code with the Melofee backdoor, trojanized OpenSSH client/server for credential harvesting, and FRPC, Chisel and ASimplePortScanner. On Windows the actors guessed RDP passwords until an administrator account worked, then deployed CopperAdu (hidden admin$ account, LocalAccountTokenFilterPolicy=1, firewall rule RasiUwpApp opening TCP 445), CopperList (LZNT1-compressed file inventory), CopperLogger (Raw Input keylogger with hidden window kbl), CopperLsa (malicious LSA security package capturing NTLM/Kerberos credentials) and a SparrowDoor variant. A passive SparrowDoor embeds WinDivert drivers to intercept inbound port 443 traffic from a specific source IP and redirect it to an internal port.

DarkWire (mid-2025 onward): intrusions into at least three major Latin American telecom providers plus foreign-affairs and justice sectors, with signs of expansion beyond the region. CopperLoader (reflective position-independent shellcode in hijacked DLLs, RC4-encrypted .dat payloads, stripped MZ/PE headers) loads CopperDoor (also called SparroWocky by ESET; modular in-memory backdoor using call-stack spoofing and gadget-based execution) or CopperDNS (C2 tunneled over DNS MX queries). Supporting tools: CopperProxy (SOCKS5, up to 300 clients, firewall rule ss1), PyProxy (PyInstaller UDP relay), CopperLsass (slave.dll loaded into LSASS as a security package; comsvcs.dll/dep.dll dump, custom SUB-XOR-ADD encryption, output renamed 1.png), SoftEther VPN renamed vmtoolsd.exe/csrss.exe, and SMB/wmiexec lateral movement. DLL side-loading pairs: ncpmif32.dll/ncptrcw.exe, winfsp.dll/fsptool.exe, libvlccore.dll/vlc.exe, DukeQt.dll/gethwid.exe, zCrashReport64.dll/zCrashReport64.exe. CopperDoor C2 uses raw TCP in TLS on 443 with certificate CNs mimicking victim domains; CopperDNS C2 uses high ports (commonly 6532) and a reused certificate with CN 8.8.8.8. The domain amelicen.com, previously reported as a SparrowDoor C2 by ESET, later appeared in CopperDNS infrastructure, and ESET reported CopperDoor replacing SparrowDoor on compromised hosts.

No CVE is named; CVSS is not applicable. BeaconBeagle correlation was attempted but the service returned HTTP 502, so no C2 matches are recorded.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1566.001 Spearphishing Attachment
- T1204.002 Malicious File
- T1059.007 JavaScript
- T1059.003 Windows Command Shell
- T1547.001 Registry Run Keys / Startup Folder
- T1136.001 Local Account
- T1547.005 Security Support Provider
- T1574.001 DLL
- T1014 Rootkit
- T1620 Reflective Code Loading
- T1564.002 Hidden Users
- T1497 Virtualization/Sandbox Evasion
- T1202 Indirect Command Execution
- T1686 Disable or Modify System Firewall
- T1003.001 LSASS Memory
- T1110.001 Password Guessing
- T1056.001 Keylogging
- T1021.001 Remote Desktop Protocol
- T1021.002 SMB/Windows Admin Shares
- T1113 Screen Capture
- T1560 Archive Collected Data
- T1071.004 DNS
- T1090 Proxy
- T1572 Protocol Tunneling

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**CopperDragon SilentDelivery - ftp.exe LOLBin Script Execution and CertFixer.msi Install (Exploitation)** (`TL-2026-5652-SPL-001`)

Detects the SilentDelivery initial-access chain described for TL-2026-5652: a spear-phishing .docx.lnk that abuses ftp.exe (-s: script mode) as a LOLBin to run a batch script, shells spawned by ftp.exe, msiexec installing the fake-certificate lure CertFixer.msi, the Strategi_AS_Referensi_April2026 lure name, and the known CertFixer.msi SHA-256. These behaviours precede deployment of the SquadC backdoor and loader.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1566.001, T1204.002, T1202, T1059.003
- **Data sources:** sysmon, microsoft_defender_for_endpoint
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h ((Image="*\\ftp.exe" CommandLine="* -s:*") OR (ParentImage="*\\ftp.exe" (Image="*\\cmd.exe" OR Image="*\\powershell.exe")) OR (Image="*\\msiexec.exe" CommandLine="*CertFixer*") OR CommandLine="*Strategi_AS_Referensi_April2026*" OR Hashes="*715c206629f59ff5b0134a33362162ce7a40a9b25aa17f0543dc9648d51a67cf*") | eval indicator=case(like(Image,"%ftp.exe"),"ftp.exe LOLBin script execution (SilentDelivery LNK lure)",like(ParentImage,"%ftp.exe"),"Shell spawned by ftp.exe",like(CommandLine,"%CertFixer%"),"CertFixer.msi installation (fake certificate lure)",true(),"Known TL-2026-5652 lure artifact") | stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_lines values(ParentImage) as parent_images by host, User, Image, indicator | convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where (FileName =~ 'ftp.exe' and ProcessCommandLine has ' -s:')
    or (InitiatingProcessFileName =~ 'ftp.exe' and FileName in~ ('cmd.exe', 'powershell.exe'))
    or (FileName =~ 'msiexec.exe' and ProcessCommandLine has 'CertFixer')
    or ProcessCommandLine has 'Strategi_AS_Referensi_April2026'
    or SHA256 =~ '715c206629f59ff5b0134a33362162ce7a40a9b25aa17f0543dc9648d51a67cf'
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
| sort by Timestamp desc
```

### Sigma

```yaml
title: CopperDragon SilentDelivery ftp.exe LOLBin Script Execution and CertFixer.msi Install
id: 3f1d2a64-8b7e-4c19-a5d2-5652a1000001
status: experimental
description: Detects ftp.exe abused with -s: to run a script (SilentDelivery LNK lure), shells spawned by ftp.exe, and msiexec installing the CertFixer.msi fake certificate lure.
references:
    - https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/
author: Threadlinqs Team
date: 2026/11/10
tags:
    - attack.initial_access
    - attack.t1566.001
    - attack.execution
    - attack.t1204.002
    - attack.t1059.003
    - attack.defense_evasion
    - attack.t1202
logsource:
    category: process_creation
    product: windows
detection:
    selection_ftp:
        Image|endswith: '\ftp.exe'
        CommandLine|contains: ' -s:'
    selection_ftp_child:
        ParentImage|endswith: '\ftp.exe'
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
    selection_msi:
        Image|endswith: '\msiexec.exe'
        CommandLine|contains: 'CertFixer'
    selection_lure:
        CommandLine|contains: 'Strategi_AS_Referensi_April2026'
    selection_hash:
        Hashes|contains: '715c206629f59ff5b0134a33362162ce7a40a9b25aa17f0543dc9648d51a67cf'
    condition: 1 of selection_*
falsepositives:
    - Administrators using ftp.exe -s: for scripted file transfers
    - Legitimate software packages that happen to be named with CertFixer
level: high
```

**Known false positives:**

- Administrators or legacy batch jobs that use ftp.exe -s: for scripted FTP transfers
- Software deployment tooling that runs msiexec with a package named CertFixer

**Tuning notes:** Exclude known automation hosts and service accounts that legitimately script ftp.exe. If your Sysmon index is not named sysmon, adjust the index. Add further lure filenames from new reporting; the ftp.exe -s: leg is the durable behavioural signal.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- CopperDragon SilentDelivery - Fake Certificate Watering-Hole URL Pattern and CertFixer.msi Delivery (Exploitation) (locked: unlock with TL Creds)
- CopperDragon DarkWire - CopperLsass/CopperLsa LSASS Credential Theft and LSA Security Package Abuse (Post-Exploitation) (locked: unlock with TL Creds)
- CopperDragon - Outbound Connections to Known C2 Infrastructure and CopperDNS Port 6532 (C2) (locked: unlock with TL Creds)
- CopperDragon OceanGate - Linux Web Service Spawning Shell, AnnobinDoor/SparrowShell Implants and Reptile Rootkit Load (Exploitation) (locked: unlock with TL Creds)
- CopperDragon DarkWire - CopperLoader DLL Side-Loading Pairs Outside Program Files (Defense Evasion) (locked: unlock with TL Creds)
- CopperDragon - Impacket wmiexec ADMIN$ Lateral Movement and Hidden admin$ Account Creation (Lateral Movement) (locked: unlock with TL Creds)
- CopperDragon - [indicator] Run Key, Hidden admin$ Account and RasiUwpApp/ss1 Firewall Rules (Post-Exploitation) (locked: unlock with TL Creds)
- CopperDragon DarkWire - CopperDNS MX Query Tunneling and Known C2 Domain Lookups (C2) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 32)

Defanged, TLP:CLEAR.

- IP address: `135.136.135[.]54`
- Domain: `microsfot[.]vip`
- File hash: `715c206629f59ff5b0134a33362162ce7a40a9b25aa17f0543dc9648d51a67cf`

Full set of 32 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe](https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/)
- [You will always remember this as the day you finally caught FamousSparrow (ESET Research)](https://www.welivesecurity.com/en/eset-research/you-will-always-remember-this-as-the-day-you-finally-caught-famoussparrow/)
- [Chinese hackers use SparroWocky malware in govt espionage attacks (BleepingComputer)](https://www.bleepingcomputer.com/news/security/chinese-hackers-use-sparrowocky-malware-in-govt-espionage-attacks/)
- [NCSC Malware Analysis Report: SparrowDoor](https://www.ncsc.gov.uk/report/mar-sparrowdoor)
- [ESET: Cyberespionage attacks by the China-aligned FamousSparrow group in the United States](https://www.eset.com/us/about/newsroom/research/cyberespionage-attacks-by-the-china-aligned-famoussparrow-group-in-the-united-states-eset-research-discovers)
- [CSA Research Note: FamousSparrow SparroWocky backdoor](https://labs.cloudsecurityalliance.org/research/csa-research-note-famoussparrow-sparrowocky-backdoor-2026091/)
- [Beware the SparroWock: the backdoor that bites (ESET Research)](https://www.welivesecurity.com/en/eset-research/beware-sparrowock-backdoor-bites-commands-catch/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5652