A year-long investigation by Check Point Research has linked three China-nexus cyber-espionage clusters targeting government, telecommunications, military and critical infrastructure organisations across 21 countries to a common malware and infrastructure ecosystem tracked as CopperDragon.
The investigation suggests that CopperDragon may function as a developer and supplier of malware and infrastructure used by multiple threat actors, rather than operating as a single espionage group. The findings connect activity previously associated with groups including FamousSparrow, Earth Estries, TropicTrooper and UAT-9244.
Check Point identified three operational clusters, named SilentDelivery, OceanGate and DarkWire. Together, they have targeted organisations across Asia, Europe and Latin America, with the investigation uncovering previously undocumented activity in Asia, particularly India.
The researchers also identified previously undocumented Windows and Linux malware, including SquadC, AnnobinDoor and SparrowShell, alongside additional details about the Sparrow framework.
The three clusters employ different methods to compromise organisations. SilentDelivery uses compromised legitimate websites to deliver fake browser certificate warnings, tricking selected visitors into downloading malicious software. OceanGate primarily targets internet-facing Linux systems, deploying custom backdoors and stealing credentials before moving into Windows environments. DarkWire has focused largely on telecommunications providers and government organisations in Latin America, using tools for credential theft, network reconnaissance and lateral movement.
The investigation also found that attackers use modified system components and rootkits to maintain access and conceal malicious activity across compromised networks.
Check Point said the targeting of government and telecommunications infrastructure is significant because access to these systems can expose sensitive communications, subscriber information and other intelligence. The researchers cautioned that shared malware and infrastructure do not necessarily establish that separate intrusions were conducted by the same threat actor, pointing instead to the possibility of a common supplier supporting multiple operators.