{"id":"CMP-202611-erjzks","kind":"campaign","aliases":[],"related":[],"title":"China-linked CopperDragon spies hit telecoms, governments and militaries in Latin America, Asia and Europe; hacked websites show a fake Chrome certificate error that installs the SquadC backdoor (Check Point)","description":null,"summary":"Check Point Research (10 Nov 2026) links three spy campaigns, which it tracked for a year, to CopperDragon. CopperDragon appears to build and supply the Sparrow malware framework (SparrowDoor and relatives) for China-nexus groups such as FamousSparrow, Earth Estries, TropicTrooper and UAT-9244. Several dozen high-profile organizations were hit. SilentDelivery (since early 2026, Europe and Asia; Czech Republic, Germany, France, Taiwan, Nepal, Hong Kong and Indonesia named): attackers hack government, shipping and IT/research websites that their targets visit. Injected JavaScript swaps the page for a fake Google Chrome SSL certificate warning in the site's language, with an 'Install certificate' / 'Certificate Fix' button. The button downloads an MSI from attacker-controlled S3 buckets that installs the new SquadC Windows backdoor or a SparrowDoor variant. SquadC is also sent by spear-phishing as an RAR with a fake .docx LNK. OceanGate (mainly Asia): attackers break into internet-facing Linux systems, then move into Windows using a SparrowDoor variant and Linux/Windows post-exploitation tools. DarkWire (Latin American telecoms and governments): uses the CopperDoor and CopperDNS backdoors. Check Point also reports Linux variants and passive backdoors, and a link to the Melofee backdoor. Which internet-facing products OceanGate exploited, and the full indicator list, are not in the part of the report we could read (unknown).","severity":"high","cvss":null,"epss":null,"exploited":true,"exploited_at":"2026-11-10T14:40:46+00:00","products":[{"name":"Windows","fixed":[],"vendor":"Microsoft"},{"name":"Google Chrome","fixed":[],"vendor":"Google"},{"name":"Linux","fixed":[]}],"ecosystems":[],"tags":["campaign","early-warning"],"not_affected_if":[],"how_to_check":"Web visitors: a site you trust suddenly shows a Chrome certificate error page with an 'Install certificate' button, or offers a 'Certificate Fix' MSI to download. Real Chrome certificate errors never offer a download. Website owners: obfuscated (jsjiami) JavaScript injected into your pages that calls a remote server at /image-check?t=, /report-url (POST) or /register-ip. Windows hosts: a registry Run key named WindowsUpdateAssist. Email: the archive Strategi_AS_Referensi_April2026.rar, containing Strategi_AS_Referensi_April2026.docx.lnk, _rels/info.dll, _rels/.rels.log and _rels/557.pdf, where the LNK uses ftp.exe to run commands. Telecoms, government, military and research organizations should check Check Point's full report for the SquadC, SparrowDoor, CopperDoor and CopperDNS hashes and C2 addresses.","fix":"Tell users never to install 'certificate fix' tools offered by a web page, and block MSI downloads from web pages or unknown S3 buckets where you can. Website operators in government, shipping and IT/research should look for injected scripts (fix XSS in input fields) and remove them. Hunt for the WindowsUpdateAssist Run key and the LNK/RAR lure, patch and watch internet-facing Linux servers, and load Check Point's indicators into your EDR and DNS/proxy blocklists. If you find SquadC or SparrowDoor, treat the host as fully compromised and look for movement into other Linux and Windows systems.","status":"open","published_at":null,"first_seen_at":"2026-11-10T14:40:46+00:00","triaged_at":"2026-11-10T14:40:46+00:00","updated_at":"2026-11-10T14:42:18+00:00","category":"other","confidence":null,"triage":{"cause":{"at":"2026-11-10T14:41:43Z","path":"tampered-install","entry":"unknown","reason":"The report says attackers hacked government, shipping and IT/research websites and served a fake Chrome certificate page whose 'Install certificate' button downloads an MSI that installs SquadC or SparrowDoor, but it does not say how the attackers got into those websites or which OceanGate products were exploited.","confidence":0.8}},"analyst_status":"done","analyst_note":null,"search":"'-202611':33A '-9244':87B '10':46B '2026':48B,99B 'also':174B,227B 'america':13A 'american':215B 'appear':62B 'asia':14A,102B,190B 'attack':114B,157B,191B 'attacker-control':156B 'backdoor':29A,167B,224B,233B,240B 'break':192B 'bucket':160B 'build':64B 'button':149B,151B 'campaign':39B,52B 'certif':23A,136B,146B,147B 'check':30A,43B,225B 'china':2A,76B 'china-link':1A 'china-nexus':75B 'chrome':22A,37A,134B 'cmp':32A 'control':158B 'copperdn':223B 'copperdoor':221B 'copperdragon':4A,60B,61B 'could':262B 'czech':103B 'darkwir':213B 'docx':186B 'download':152B 'dozen':89B 'earli':41B,98B 'early-warn':40B 'earth':82B 'erjzks':34A 'error':24A 'estri':83B 'europ':16A,100B 'exploit':211B,247B 'face':196B,244B 'fake':21A,132B,185B 'famoussparrow':81B 'fix':148B 'framework':70B 'franc':106B 'full':250B 'germani':105B 'googl':133B 'google':36A 'govern':8A,116B,218B 'group':78B 'hack':17A,115B 'high':91B 'high-profil':90B 'hit':6A,95B 'hong':109B 'indic':251B 'indonesia':112B 'inject':125B 'instal':26A,145B,162B 'internet':195B,243B 'internet-fac':194B,242B 'it/research':119B 'javascript':126B 'kong':110B 'languag':142B 'latin':12A,214B 'link':3A,49B,236B 'linux':38A,197B,229B 'linux/windows':208B 'list':252B 'lnk':187B 'main':189B 'malwar':69B 'melofe':239B 'militari':10A 'move':200B 'msi':154B 'name':113B 'nepal':108B 'new':164B 'nexus':77B 'nov':47B 'oceang':188B,246B 'organ':93B 'page':129B 'part':257B 'passiv':232B 'phish':179B 'point':31A,44B,226B 'post':210B 'post-exploit':209B 'product':245B 'profil':92B 'rar':182B 'read':263B 'relat':73B 'report':228B,260B 'republ':104B 'research':45B 's3':159B 'sent':175B 'sever':88B 'ship':117B 'show':19A 'silentdeliveri':96B 'sinc':97B 'site':140B 'sparrow':68B 'sparrowdoor':71B,170B,205B 'spear':178B 'spear-phish':177B 'spi':5A,51B 'squadc':28A,165B,172B 'ssl':135B 'suppli':66B 'swap':127B 'system':198B 'taiwan':107B 'target':123B 'telecom':7A,216B 'three':50B 'tool':212B 'track':55B 'tropictroop':84B 'uat':86B 'unknown':264B 'use':203B,219B 'variant':171B,206B,230B 'visit':124B 'warn':42B,137B 'websit':18A,120B 'window':166B,202B 'windows':35A 'year':58B","nicknames":["CopperDragon","Sparrow framework","SparrowDoor","SquadC","SilentDelivery","OceanGate","DarkWire","CopperDoor","CopperDNS","FamousSparrow","Earth Estries"],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["chrome","copperdns","copperdoor","copperdragon","darkwire","earthestries","famoussparrow","googlechrome","linux","oceangate","silentdelivery","sparrowdoor","sparrowframework","squadc","windows"],"ptokens":["chrome","google","linux","windows"],"labels":["campaign","earlywarning","high","other"],"campaign_type":"exploitation","search_a":"'-202611':33A 'america':13A 'asia':14A 'backdoor':29A 'certif':23A 'check':30A 'china':2A 'china-link':1A 'chrome':22A,37A 'cmp':32A 'copperdragon':4A 'erjzks':34A 'error':24A 'europ':16A 'fake':21A 'google':36A 'govern':8A 'hack':17A 'hit':6A 'instal':26A 'latin':12A 'link':3A 'linux':38A 'militari':10A 'point':31A 'show':19A 'spi':5A 'squadc':28A 'telecom':7A 'websit':18A 'windows':35A","search_b":"'-9244':87B '10':46B '2026':48B,99B 'also':174B,227B 'american':215B 'appear':62B 'asia':102B,190B 'attack':114B,157B,191B 'attacker-control':156B 'backdoor':167B,224B,233B,240B 'break':192B 'bucket':160B 'build':64B 'button':149B,151B 'campaign':39B,52B 'certif':136B,146B,147B 'check':43B,225B 'china':76B 'china-nexus':75B 'chrome':134B 'control':158B 'copperdn':223B 'copperdoor':221B 'copperdragon':60B,61B 'could':262B 'czech':103B 'darkwir':213B 'docx':186B 'download':152B 'dozen':89B 'earli':41B,98B 'early-warn':40B 'earth':82B 'estri':83B 'europ':100B 'exploit':211B,247B 'face':196B,244B 'fake':132B,185B 'famoussparrow':81B 'fix':148B 'framework':70B 'franc':106B 'full':250B 'germani':105B 'googl':133B 'govern':116B,218B 'group':78B 'hack':115B 'high':91B 'high-profil':90B 'hit':95B 'hong':109B 'indic':251B 'indonesia':112B 'inject':125B 'instal':145B,162B 'internet':195B,243B 'internet-fac':194B,242B 'it/research':119B 'javascript':126B 'kong':110B 'languag':142B 'latin':214B 'link':49B,236B 'linux':197B,229B 'linux/windows':208B 'list':252B 'lnk':187B 'main':189B 'malwar':69B 'melofe':239B 'move':200B 'msi':154B 'name':113B 'nepal':108B 'new':164B 'nexus':77B 'nov':47B 'oceang':188B,246B 'organ':93B 'page':129B 'part':257B 'passiv':232B 'phish':179B 'point':44B,226B 'post':210B 'post-exploit':209B 'product':245B 'profil':92B 'rar':182B 'read':263B 'relat':73B 'report':228B,260B 'republ':104B 'research':45B 's3':159B 'sent':175B 'sever':88B 'ship':117B 'silentdeliveri':96B 'sinc':97B 'site':140B 'sparrow':68B 'sparrowdoor':71B,170B,205B 'spear':178B 'spear-phish':177B 'spi':51B 'squadc':165B,172B 'ssl':135B 'suppli':66B 'swap':127B 'system':198B 'taiwan':107B 'target':123B 'telecom':216B 'three':50B 'tool':212B 'track':55B 'tropictroop':84B 'uat':86B 'unknown':264B 'use':203B,219B 'variant':171B,206B,230B 'visit':124B 'warn':42B,137B 'websit':120B 'window':166B,202B 'year':58B","search_c":"","cause_entry":"unknown","cause_path":"tampered-install","disclosures_checked_at":null,"first_public_at":"2026-11-10T14:01:14+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202611-erjzks","url":null,"severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-10T14:40:46+00:00","fetched_at":"2026-11-10T14:40:46+00:00","note":null}],"documents":[{"id":115414,"url":"https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/","title":"Check Point Research: Not All That Glitters Is Gold: Tracking CopperDragon’s Sparrow Framework Around the Globe","kind":"blog","source":"blog","publisher":null,"text":"Not All That Glitters Is Gold: Tracking CopperDragon’s Sparrow Framework Around the Globe\n\nKey Points Introduction Over the past year, Check Point Research investigated a series of intrusion campaigns targeting several dozens of high-profile organizations across Latin America, Asia, and Europe. These campaigns initially appeared to be independent operations, each using different backdoors, post-exploitation tools and operational pace. However, we identified numerous connections between the tools and their […] The post Not All That Glitters Is Gold: Tracking CopperDragon’s Sparrow Framework Around the Globe appeared first on Check Point Research .","published_at":"2026-11-10T14:01:14+00:00","relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}