Not All That Glitters Is Gold: Tracking CopperDragon’s Sparrow Framework Around the Globe
Admiralty grading (A–F · 1–6)
Source reliability
- A Completely reliable
- B Usually reliable
- C Fairly reliable
- D Not usually reliable
- E Unreliable
- F Cannot be judged
Information credibility
- 1 Confirmed
- 2 Probably true
- 3 Possibly true
- 4 Doubtful
- 5 Improbable
- 6 Cannot be judged
NATO Admiralty (AJP-2.1) grades confidence, independent of the risk score. Cross-source corroboration isn't tracked for non-CVE news, so single-source items are capped at a lower credibility number; a low number does not imply low quality.
Key insight
The report adds new TTPs and infrastructure details on CopperDragon's Windows espionage backdoors beyond patch information, as no CVE or patch is involved.
Description
Check Point Research describes the threat actor tracked as CopperDragon and its Sparrow framework for Windows systems. The toolset includes CopperLoader, CopperDoor, CopperDNS, CopperProxy, CopperLsass, CopperSplit, and SparrowDoor, which use reflective DLL loading, process hollowing, and modular backdoor capabilities, among other techniques. CopperDNS tunnels C2 communications through DNS MX queries, making detection in network traffic more difficult. The analysis characterizes the activity as an espionage campaign and provides TTPs for detection; there is no CVE or specific patch reference.
Risk score
- strategic relevance
- 0.85
- consensus penalty
- -5.00
Path: strategic
Consensus check
The pipeline self-checks before delivery. These rules lowered the score:
-
VENDOR_MISMATCHVendor not found in alert title −5
- Consensus penalty:
- −5.0
- Total penalty:
- −5.0