One Supplier. Three Spy Campaigns. 21 Countries.
Espionage used to be artisanal: one crew, one toolkit, one set of targets. A year-long investigation published by Check Point Research describes something more industrial — a suspected single supplier, tracked as CopperDragon, developing and handing out the malware and infrastructure behind three separate China-nexus espionage campaigns running at the same time, against telecommunications providers, governments, militaries, research institutions and critical infrastructure across 21 countries.
CopperDragon is the name Check Point gives the entity behind the Sparrow malware framework. The trail started with FamousSparrow, a group previously linked to Salt Typhoon and known for its SparrowDoor backdoor. Over time it became clear that several distinct actors — FamousSparrow, Earth Estries, Tropic Trooper and others — were working with a shared toolset, possibly supplied by the same entity. Check Point calls that entity a possible “digital quartermaster”: it builds the weapons and the roads; other crews do the shooting.
Three clusters, one toolkit
The investigation divides the activity into three operational clusters. SilentDelivery works mainly in Europe and Asia, with highly selective watering-hole attacks — including in Germany, France and the Czech Republic — where compromised websites served a fake Google Chrome SSL certificate warning that tricked visitors into installing the SquadC backdoor through trojanized installers. The cluster was still active while the report was being finalized, and part of it has since been independently reported by Positive Technologies. OceanGate operates primarily in Asia, with previously undocumented activity and a particular focus on India: Linux backdoors, credential-harvesting Windows tools, kernel-level components that concealed traffic on port 443, and modified SSH components built to capture credentials. DarkWire is concentrated in Latin America, targeting telecommunications providers and government organizations with DNS tunneling and proxy infrastructure to move data out quietly.
Along the way, researchers uncovered previously undocumented malware for both Windows and Linux — SquadC, AnnobinDoor and SparrowShell — plus new detail on the Sparrow framework itself, including a passive backdoor and kernel-level capabilities. DarkWire’s kit adds its own named tools, CopperDoor and CopperDNS, for collection and covert channels. The investigation also widened the known map: activity in Asia that had never been documented before, with a significant focus on India, pushed the total to 21 countries across Latin America, Europe and Asia.
The activity has been building since mid-2025 and accelerated through 2026. Check Point is appropriately careful about the politics: the evidence, it warns, does not establish the specific geopolitical motivation behind each operation, and the relationship between FamousSparrow and Salt Typhoon — the telecom-focused actor that first made the Sparrow name notorious — remains unclear in the details. What the research does establish, with a year of telemetry behind it, is the shared supply chain underneath three campaigns that had previously been reported as separate stories.
Why the telecoms come first
The target list has a center of gravity: carriers. A telecommunications provider sits on the exact data an intelligence service wants — call records showing who spoke to whom, subscriber data, phone locations, the contents of SMS messages, and, at the very top of the pile, the lawful-intercept systems carriers are required to maintain for their own governments. Compromise the network that carries the data, and much of the data eventually comes to you. That is why telecom intrusions keep appearing at the center of state espionage reporting, from the Sparrow ecosystem here to the Turla campaign against government Exchange servers and the BroadWorks phone-system intrusions flagged by CISA this week.
For defenders, the quartermaster model changes the math. Blocking one crew’s infrastructure no longer ends the story if the supplier simply reissues the toolkit to the next crew. The practical work is in the shared layer: hunt for the Sparrow framework’s fingerprints rather than any single campaign’s, treat watering-hole lures that spoof browser security warnings as a carrier-grade threat, and audit the Linux and SSH layers of telecom infrastructure for the modified components OceanGate favors. One supplier arming three campaigns is a problem — but it is also a single point of failure, if the industry learns to aim at it.