One Toolmaker May Be Arming Three China-Nexus Espionage Campaigns

On November 10, 2026, Check Point Research tied three espionage campaigns against several dozen high-profile organizations in Latin America, Asia, and Europe to one malware toolkit, the Sparrow framework. It calls the possible developer and supplier CopperDragon, which may equip several China-nexus groups, including FamousSparrow, Earth Estries, TropicTrooper, and UAT-9244.

The craftiest, SilentDelivery, has run since early 2026. It plants script on government, shipping, and IT and research sites its targets visit, swaps the page for a fake Chrome certificate error, and pushes a “Certificate Fix” installer that drops the new SquadC backdoor or a SparrowDoor variant. Once a victim is infected, the fake warning stops appearing.

OceanGate got into Asian government and critical infrastructure networks through exposed Linux servers. DarkWire targeted at least three major Latin American telecoms, though its tie to CopperDragon rests on infrastructure, not code. There’s no patch to apply: Check Point published indicators, and Windows admins can check for a Run key value named WindowsUpdateAssist.

Source: Infosecurity Magazine