--- id: "CMP-202611-erjzks" page: "https://infrastack.ai/live/CMP-202611-erjzks" kind: "campaign" aliases: [] title: "China-linked CopperDragon spies hit telecoms, governments and militaries in Latin America, Asia and Europe; hacked websites show a fake Chrome certificate error that installs the SquadC backdoor (Check Point)" severity: "high" cvss: null epss: null exploited: true status: "open" category: "other" products: [{"name": "Windows", "fixed": [], "vendor": "Microsoft"}, {"name": "Google Chrome", "fixed": [], "vendor": "Google"}, {"name": "Linux", "fixed": []}] ecosystems: [] tags: ["campaign", "early-warning"] not_affected_if: [] published_at: null first_seen_at: "2026-11-10T14:40:46+00:00" updated_at: "2026-11-10T14:42:18+00:00" sources: [{"source": "analyst", "url": null, "first_seen_at": "2026-11-10T14:40:46+00:00"}] exploit_sources: [] --- # China-linked CopperDragon spies hit telecoms, governments and militaries in Latin America, Asia and Europe; hacked websites show a fake Chrome certificate error that installs the SquadC backdoor (Check Point) Link for people: https://infrastack.ai/live/CMP-202611-erjzks (this .md is for agents) Check Point Research (10 Nov 2026) links three spy campaigns, which it tracked for a year, to CopperDragon. CopperDragon appears to build and supply the Sparrow malware framework (SparrowDoor and relatives) for China-nexus groups such as FamousSparrow, Earth Estries, TropicTrooper and UAT-9244. Several dozen high-profile organizations were hit. SilentDelivery (since early 2026, Europe and Asia; Czech Republic, Germany, France, Taiwan, Nepal, Hong Kong and Indonesia named): attackers hack government, shipping and IT/research websites that their targets visit. Injected JavaScript swaps the page for a fake Google Chrome SSL certificate warning in the site's language, with an 'Install certificate' / 'Certificate Fix' button. The button downloads an MSI from attacker-controlled S3 buckets that installs the new SquadC Windows backdoor or a SparrowDoor variant. SquadC is also sent by spear-phishing as an RAR with a fake .docx LNK. OceanGate (mainly Asia): attackers break into internet-facing Linux systems, then move into Windows using a SparrowDoor variant and Linux/Windows post-exploitation tools. DarkWire (Latin American telecoms and governments): uses the CopperDoor and CopperDNS backdoors. Check Point also reports Linux variants and passive backdoors, and a link to the Melofee backdoor. Which internet-facing products OceanGate exploited, and the full indicator list, are not in the part of the report we could read (unknown). _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - :Windows affected range not listed fixed no fixed version listed - :Google Chrome affected range not listed fixed no fixed version listed - :Linux affected range not listed fixed no fixed version listed ## Cause How the attacker got in: not disclosed yet (unknown). The report says attackers hacked government, shipping and IT/research websites and served a fake Chrome certificate page whose 'Install certificate' button downloads an MSI that installs SquadC or SparrowDoor, but it does not say how the attackers got into those websites or which OceanGate products were exploited. How it reached others: their users installed or auto-updated it (tampered-install). Last month's incidents with the same cause, and the full checklist: https://infrastack.ai/live/causes.md#tampered-install ## How to check Web visitors: a site you trust suddenly shows a Chrome certificate error page with an 'Install certificate' button, or offers a 'Certificate Fix' MSI to download. Real Chrome certificate errors never offer a download. Website owners: obfuscated (jsjiami) JavaScript injected into your pages that calls a remote server at /image-check?t=, /report-url (POST) or /register-ip. Windows hosts: a registry Run key named WindowsUpdateAssist. Email: the archive Strategi_AS_Referensi_April2026.rar, containing Strategi_AS_Referensi_April2026.docx.lnk, _rels/info.dll, _rels/.rels.log and _rels/557.pdf, where the LNK uses ftp.exe to run commands. Telecoms, government, military and research organizations should check Check Point's full report for the SquadC, SparrowDoor, CopperDoor and CopperDNS hashes and C2 addresses. ## Fix Tell users never to install 'certificate fix' tools offered by a web page, and block MSI downloads from web pages or unknown S3 buckets where you can. Website operators in government, shipping and IT/research should look for injected scripts (fix XSS in input fields) and remove them. Hunt for the WindowsUpdateAssist Run key and the LNK/RAR lure, patch and watch internet-facing Linux servers, and load Check Point's indicators into your EDR and DNS/proxy blocklists. If you find SquadC or SparrowDoor, treat the host as fully compromised and look for movement into other Linux and Windows systems. ## Timeline - 2026-11-10T14:40:46+00:00 analyst ## Documents - [describes] Check Point Research: Not All That Glitters Is Gold: Tracking CopperDragon’s Sparrow Framework Around the Globe https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/ --- _Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_