Sparrow Malware Ecosystem Unifies Three China-Linked Clusters Targeting Telecoms and Governments

The clusters deployed distinct initial access methods yet converged on Sparrow-derived backdoors including SquadC, SparrowDoor variants, and CopperDoor. SilentDelivery used obfuscated JavaScript on government and research sites in Europe and Asia to push trojanized MSI files, while OceanGate compromised Linux servers before lateral movement and DarkWire hit Latin American telecoms with DNS tunneling. Positive Technologies independently flagged the same watering-hole domains and geofenced C2 checks in August 2026.

CopperDragon's role as digital quartermaster explains the reuse of code across FamousSparrow, Earth Estries, Tropic Trooper, and UAT clusters without requiring direct operator overlap. Contract and procurement patterns show similar tool-sharing models in prior Salt Typhoon activity, though technical attribution here rests on binary similarities and infrastructure rather than victim statements.

The operation reveals scalable state resource allocation for persistent espionage against critical infrastructure. Continued monitoring of Sparrow C2 domains and MSI signing certificates will likely surface additional clusters within the next quarter.

Future campaigns will probably expand the same watering-hole and phishing vectors to new sectors in the Middle East and Africa based on observed domain selection.