Summary
- Check Point identified three clusters targeting government, telecommunications and critical infrastructure organisations across 21 countries.
- CopperDragon may supply malware and infrastructure to separate China-nexus operators rather than constitute one uniform attacking group.
- European activity involved compromised legitimate websites in Germany, France and Czechia that presented deceptive Chrome certificate warnings.
Three cyber-espionage operations targeting government, telecommunications and critical infrastructure organisations across 21 countries have been connected through shared malware and infrastructure, according to new research from Check Point.
The investigation, published on 10 November, links activity in Europe, Asia and Latin America to an entity researchers track as CopperDragon. Rather than treating the activity as one centrally operated campaign, Check Point believes CopperDragon may develop or supply tools and infrastructure to several China-associated espionage groups.
The findings bring together previously separate operations involving the Sparrow malware framework, including activity associated with FamousSparrow, Earth Estries and other China-nexus threat actors. Check Point divided the observed campaigns into three clusters based on their targeting, geography and technical methods.
The researchers have not established that every intrusion was conducted by the same operators. Their assessment instead raises the possibility that different groups are drawing on a common technical supplier.
European websites used to deliver malicious software
One cluster provides the clearest European connection. Check Point identified attacks involving legitimate websites associated with government, shipping, information technology and research organisations, including sites in Germany, France and Czechia.
After compromising these websites, attackers inserted malicious code designed to identify selected visitors and present them with deceptive browser security warnings. The warnings imitated Chrome certificate errors and encouraged users to install what appeared to be a certificate repair utility.
Rather than correcting a browser problem, the download could install a backdoor. By distributing malicious software through legitimate websites, the operators could target visitors to trusted organisations without relying entirely on conventional phishing messages.
Check Point describes the technique as selective watering-hole activity. The compromised website serves as the delivery point, while the attacker’s additional checks determine which visitors receive the malicious content.
Elsewhere, the researchers observed targeting in Asia, including previously undocumented activity focused on India. Attackers compromised internet-facing Linux systems and used specialised tools to maintain access and obtain credentials before moving into Windows environments.
The investigation identified additional malware components designed to conceal processes and network activity, facilitate credential theft and preserve access inside compromised infrastructure.
Shared infrastructure complicates attribution
Other activity concentrated in Latin America has targeted telecommunications providers and government organisations. Check Point identified tools used for credential collection, internal reconnaissance and movement between systems, alongside components associated with the broader framework.
Telecommunications networks are particularly sensitive espionage targets because access to the appropriate systems can expose information beyond an operator’s own business records. Depending on the infrastructure compromised, attackers may obtain communications metadata, subscriber location information or material associated with government and law-enforcement activity.
Those are potential intelligence consequences of compromising telecommunications systems, not confirmation that every category of data was obtained during the observed campaigns.
The connection between these operations also complicates traditional attribution. Malware families and command infrastructure can provide valuable evidence when investigators compare incidents, but common tooling does not necessarily establish that the same people directed each intrusion.
If CopperDragon operates as a supplier, individual threat groups may acquire related capabilities while retaining distinct targeting priorities and operational practices. This would help explain why similar technical artefacts appear across campaigns with different victims and geographical concentrations.
That distinction affects incident investigation. Organisations responding to a compromise may identify a familiar malware family without yet understanding which operator used it, how initial access was obtained or whether the intrusion forms part of a wider intelligence campaign.
The combination of compromised public-facing servers, trusted website delivery and movement between Linux and Windows systems also illustrates the breadth of environments involved. Detection limited to Windows endpoints could miss activity beginning on exposed Linux infrastructure, while ordinary website reputation checks may provide limited protection when a legitimate site has been altered to deliver malicious content selectively.
Check Point’s investigation extends the known geographical footprint of Sparrow-related activity and identifies previously undocumented malware. Its proposed CopperDragon supplier model remains a research assessment rather than an independently established organisational structure or definitive attribution of every linked incident.
