cross-posted from: https://scribe.disroot.org/post/12452577

• Check Point Research connected three operational clusters across Latin America, Asia and Europe, targeting government, telecom, military, research and critical infrastructure organizations.
• CopperDragon may act as a digital quartermaster, supplying malware and infrastructure to multiple China-nexus threat actors using the Sparrow framework.
• Activity was observed across 21 countries, with the research expanding known victimology and uncovering previously undocumented activity in Asia, including significant focus on India.
• Researchers uncovered previously undocumented Windows and Linux malware, including SquadC, AnnobinDoor and SparrowShell, alongside new details about the Sparrow framework.
• Attackers used different entry methods, from compromised internet-facing servers to selective watering-hole attacks involving fake browser certificate warnings.

…

A year-long Check Point Research investigation has connected three China-nexus cyber-espionage clusters targeting government, telecommunications and critical infrastructure organizations across Europe, Asia and Latin America. While parts of this activity have previously been reported separately, the wider investigation reveals new insights and connections through shared malware and infrastructure, pointing to a broader ecosystem linked to an entity Check Point Research tracks as “CopperDragon”.

CopperDragon may operate as a digital quartermaster, developing or supplying malware and infrastructure to multiple sophisticated China-nexus threat actors. By examining the connections between these campaigns, Check Point Research provides a broader view of an espionage ecosystem spanning Windows and Linux environments, multiple regions and some of the world’s most strategically important sectors.

…

Archived