An entity tracked as “CopperDragon” operates as a digital quartermaster, developing and supplying malware to multiple threat actors working on behalf of China, new research reveals.

According to cybersecurity firm Check Point, three China-nexus cyber-espionage clusters are targeting telecommunications, government, military, research, and critical infrastructure organizations across 21 countries in Europe, Latin America, and Asia.

Parts of this activity were previously reported separately. Check Point researchers say the threat actors share malware and infrastructure, pointing to a broader ecosystem linked to an entity tracked as “CopperDragon.”

Targets across 21 countries

It operates as a sort of a digital quartermaster, developing or supplying malicious tools to multiple threat actors, working from or for (or both) China.

In other words, “CopperDragon” may instead represent a common supplier, helping explain why related tools and infrastructure appear across otherwise distinct espionage campaigns.

For instance, one cyber espionage campaign, tracked as Silver Dragon, was recently found to be hiding inside legitimate Windows services and using Google Drive as a covert communications channel.

Another Chinese hacking group, tracked as UNC2814 and “Gallium,” was disrupted by Google earlier this year.

In all of these cases, the attackers are targeting multiple regions and some of the world’s most strategically important sectors, researchers say.

According to Check Point's report, three distinct operational clusters – SilentDelivery, OceanGate, and DarkWire – are targeting critical sectors across 21 countries. These groups are distinguished by their specific geography, targeting focus, attack techniques, and malware tools.

The company says it has uncovered previously undocumented Windows and Linux malware, including SquadC, AnnobinDoor, and SparrowShell.

For example, the SilentDelivery campaign targeted organizations in Germany, France, and Czechia by hacking legitimate government, shipping, IT, and research websites. Selected visitors to those sites saw fake certificate errors that tricked them into installing a “fix,” which was actually a backdoor.

The DarkWire cluster operates primarily in Latin America. The campaign targets telecommunications providers and government organizations using tools designed for credential harvesting, internal reconnaissance, and network movement.

They know whom we talk to

Government and telecommunications organizations can provide significant intelligence value to espionage operations.

A compromise of a government network can expose sensitive information, credentials and communications, while sustained access can create opportunities for continued intelligence collection,

Check Point said.

Telecommunications providers are also uniquely valuable targets for cyber espionage. Compromise one, and attackers can see far beyond the provider itself.

Depending on which systems the threat actors reach, they can collect call detail records that reveal who talks to whom, when, and for how long. They can also track subscriber locations and read SMS messages.

In some environments, access may extend to lawful intercept systems, exposing which people government and law-enforcement agencies are monitoring.

This makes the concentration of DarkWire activity in Latin America particularly significant. The targeting takes place against a backdrop of growing strategic and economic competition involving China, the US, and countries across the region.

“CopperDragon gives us a wider view of how modern cyber espionage may be organized, with shared malware and infrastructure potentially supporting different operations across countries, platforms, and sectors,” Sergey Shykevich, director of threat intelligence at Check Point, said.

“The focus on telecommunications and government networks is particularly significant because compromising these environments can provide intelligence far beyond a single organization, potentially exposing communications, locations, and sensitive government activity.”