Check Point Research’s November 10 report connects three distinct espionage clusters through the Sparrow malware ecosystem. Its year-long investigation covers activity across Latin America, Asia and Europe, including intrusions observed during 2025–2026.
SilentDelivery used compromised websites and fake certificate-repair installers to deliver backdoors. OceanGate initially compromised internet-facing Linux systems before moving into Windows environments. DarkWire targeted telecommunications providers and government organizations, deploying CopperDoor and the DNS-tunneling CopperDNS backdoor.
The research also documents SparrowShell for Linux and SparrowDoor variants for Windows, including capabilities intended to conceal activity or maintain access. Targets included telecommunications, government, military, research and critical-infrastructure organizations.
Check Point tracks CopperDragon as a possible developer and supplier supporting China-nexus groups. Shared malware code and infrastructure support that ecosystem assessment; they do not establish that one operator conducted every intrusion.
Defenders should use the report’s indicators alongside behavioral evidence, including suspicious certificate installers and unexpected changes to SSH components.
