Check Point Research published a report on November 10 describing three activity clusters it links through shared infrastructure and malware code similarities in the cross-platform Sparrow framework. The DarkWire link rests mainly on infrastructure overlap, not code. It tracks a possible common supplier as CopperDragon, a “possible digital quartermaster” for several China-nexus actors. It does not name one operator behind all three clusters, and warns that shared tooling or infrastructure does not necessarily mean the same actor ran two intrusions.
What Check Point reports
- SilentDelivery: selective watering-hole attacks in Europe and Asia delivering a new backdoor, SquadC, or a SparrowDoor variant. Compromised sites belonged to government, shipping, and IT and research organisations. Visitors saw a fake Chrome certificate error offering an “Install certificate” fix. Check Point believes three compromised S3 buckets hosted the next stage.
- OceanGate: 2025 to 2026 activity against government and critical infrastructure, mainly in Asia. Check Point says the tooling and TTPs are consistent with those previously reported by multiple vendors and tracked as FamousSparrow. Intrusions began on Linux, then moved to Windows and domain administrator, with credential theft and exfiltration.
- DarkWire: first seen mid-2025, mainly in Latin America with signs of expansion. Check Point reports at least three major regional telecom providers plus foreign affairs and justice bodies as victims. New backdoors CopperDoor and CopperDNS appear to be the primary implants. Supporting tools include an LSASS dumper and SoftEther VPN renamed to names like vmtoolsd.exe and csrss.exe. Lateral movement used SMB and WMI.
How firm is the linkage
Check Point found no direct code similarity between DarkWire and the rest of the CopperDragon toolset beyond general design patterns. The link it cites is infrastructure: a domain previously reported as a SparrowDoor C2 server also appears in CopperDNS infrastructure. It also saw files from both families uploaded to VirusTotal around the same time. Check Point notes FamousSparrow was previously also linked to Salt Typhoon, but the relationship details remain unclear; The Hacker News paraphrases this more strongly, as an assessed overlap, and we follow Check Point’s wording. Check Point’s wording is hedged (“possible”), and we found no formal confidence level in the Check Point or Hacker News articles as of 2026-11-11. Check Point ties SilentDelivery to CopperDragon through a loader DLL used previously in the FamousSparrow toolset and C2 characteristics such as layout, banners and reused TLS certificates. Our assessment: the clusters are plausibly connected, but the shared-supplier model is a hypothesis.
What it means for sectors
Communications. Telecom operators are DarkWire’s clearest target. Our assessment: operators outside Latin America should read the reported expansion as a prompt to hunt, not as confirmed exposure.
Transport and critical infrastructure. Our reading of the sector mapping: Check Point names shipping and IT/research sites as watering-hole hosts, not transport operators as victims. SilentDelivery’s delivery route is a trusted partner or sector site, so staff can be reached without touching your own perimeter.
Recommended actions
- Hunt endpoint and DNS logs for the indicators in Check Point’s report, taking them from the original rather than third-party copies.
- Alert on SoftEther VPN binaries named like vmtoolsd.exe or csrss.exe, and on unexpected LSASS access.
- Train staff that a browser error offering a certificate installer is a lure.
- Give Linux servers the same monitoring as Windows hosts, since OceanGate began there.
- If you run a site serving government, shipping or research audiences, check it for injected scripts and audit cloud storage buckets for unexpected objects.