Actively exploited Security news
CopperDragon supplies China-nexus spies with the Sparrow toolset
On 10 November 2026 Check Point Research published a year-long investigation into the Sparrow tool family and its likely developer, which it calls CopperDragon. According to CPR, several China-nexus espionage groups share the tools against telecoms, governments and the military – and one of the three campaigns it describes used compromised websites showing a fake Chrome certificate error.
Key points
- Check Point attributes the Sparrow toolset to CopperDragon, which it assesses develops and supplies tools to China-nexus groups such as FamousSparrow, Earth Estries, TropicTrooper and UAT-9244. CPR stresses that shared tooling does not mean the same group carried out an intrusion.
- The SilentDelivery campaign (tracked since early 2026) compromised legitimate websites and replaced their content with a fake Chrome certificate error offering CertFixer.msi. Target countries include Czechia, Germany, France, Taiwan, Nepal, Hong Kong and Indonesia.
- OceanGate broke in through a vulnerable internet-facing Linux server; DarkWire targets at least three major Latin American telecoms. The arsenal includes Windows and Linux backdoors, a rootkit, trojanised SSH that logs passwords and LSASS credential theft tools.
- Check Point names no CVE. It published more than 50 file hashes, 14 domains and nearly a hundred IP addresses.
What happened
On 10 November 2026 Check Point Research (CPR) published the results of a roughly year-long investigation into the Sparrow tool family. It calls the likely developer and supplier CopperDragon and describes it as a "digital quartermaster" for China-nexus espionage groups. According to CPR, the tools are used by FamousSparrow, Earth Estries, TropicTrooper and UAT-9244, among others. CPR also cautions that shared tools or infrastructure don't by themselves mean the same group ran a given intrusion.
The report covers three campaigns:
| Campaign | Where and who (per CPR) | Initial access |
|---|---|---|
| SilentDelivery | Czechia, Germany, France, Taiwan, Nepal, Hong Kong, Indonesia | compromised legitimate websites with a fake certificate error, spear phishing with a RAR archive |
| OceanGate | mainly government and critical infrastructure in Asia | a vulnerable internet-facing Linux server (product not named) |
| DarkWire | at least three major Latin American telecoms and government bodies | not described |
How the attack works
SilentDelivery. A script obfuscated with jsjiami replaces the compromised page with a fake Chrome certificate warning and a "Certificate Fix" button. The CertFixer.msi installer launches the SquadC backdoor, which checks for a sandbox, only runs while a browser is open and persists through a Run key value named WindowsUpdateAssist. It can list and delete files, run commands and take screenshots. In one case the attackers got into the website through an XSS flaw in an unsanitised input field.
The rest of the arsenal. On Windows, CPR describes the SparrowDoor backdoor (including a passive variant that uses the WinDivert driver to intercept traffic on port 443) and the modular CopperDoor, which evades EDR, plus its CopperDNS variant tunnelling over DNS MX queries. There are DLL sideloading loaders, a SOCKS5 proxy, a keylogger, an LSASS dumper, a malicious LSA package that harvests NTLM and Kerberos credentials, and CopperAdu, which creates a hidden admin$ administrator account and opens SMB on port 445. On Linux there is SparrowShell with a modified Reptile rootkit, the Go-based AnnobinDoor, and trojanised ssh and sshd binaries that log administrators' passwords.
Who is affected
Targets include telecom providers, government, military, research institutions, critical infrastructure, foreign affairs and justice. The websites abused in SilentDelivery belonged to government, shipping and IT/research organisations. CPR names no individual victims. Any employee who runs the fake "fix" on a compromised site is at risk, so the warning is relevant well beyond security teams.
How to tell if you've been hit
A selection of indicators from the CPR report (the full list, with dozens more IPs and hashes, is in the source). Domains and IPs are defanged:
# Domains
microsfot[.]vip
microscoft[.]vip
aistei[.]com
astorialaza[.]com
windowsdefender.it[.]com
windowsupdates[.]us
microupdate[.]me
windefender[.]net
seosnskorea[.]com
amelicen[.]com
jamvybez[.]com
artfingo[.]com
faceorkut[.]com
aauctioneer[.]com
# SilentDelivery IPs
135.136.135[.]54
103.141.235[.]123
109.205.195[.]131
158.255.213[.]189
165.154.227[.]16
45.197.12[.]11
91.210.164[.]5
# SHA-256 of CertFixer.msi (SquadC installer)
715c206629f59ff5b0134a33362162ce7a40a9b25aa17f0543dc9648d51a67cf
b379d07ba81d4190490d9893b2d6d830ff594e042dce26053ef07794d0403787
e5f7bbfc187264336dea5dfebfb5a7dd1e7fcdcc9692db55fbe6eb4d28f027bc
e9f2f42ea3611096879f4152a7d78bb3a78a4dbead1c3b7e366dce485207551f
f44159bec1d4d3f340652cd3c6e250dcf2bdb266e5400d3e267f0466d290dda0
f51dc5e1848daee4e607d46faa25033e1151060cd3482ad4439754440d6c4c01
# Host artefacts
Run value: WindowsUpdateAssist
account: admin$
firewall rules: RasiUwpApp (TCP 445), ss1
LSASS dump renamed to 1.png
SoftEther VPN renamed to vmtoolsd.exeOther leads from CPR: TLS certificates with a fake CN=8.8.8.8, LocalAccountTokenFilterPolicy set to 1, dumps via comsvcs.dll MiniDump, a loaded WinDivert driver, unexpected kernel modules on Linux, and ssh/sshd binaries that don't match the distribution package (on Debian/Ubuntu debsums -c openssh-client openssh-server, on RHEL rpm -V openssh-clients openssh-server).
Our IOC extractor turns the list into clean SIEM or firewall input, and the hash calculator checks file hashes. Both run entirely in your browser.
What to do
- Search proxy, DNS and EDR logs for the domains, IPs and hashes above – especially if you are a telecom, government, military or research organisation.
- Hunt on endpoints and servers for an
admin$account, aRasiUwpAppfirewall rule, aWindowsUpdateAssistRun value and sideloaded DLLs underC:\ProgramDataandC:\Windows\debug. - Verify SSH integrity on internet-facing Linux servers and patch everything exposed to the internet.
- Tell users that no website ever needs them to install anything to fix a certificate. You can restrict MSI installs from the browser with policy (AppLocker, WDAC).
- If you find traces, treat the passwords of every account that logged on to the machine as compromised (the tools steal from both LSASS and SSH) and report the incident to your national CERT.
Timeline
FAQ
Should ordinary users worry?
The targets are organisations – telecoms, government, military and research. One rule applies to everyone, though: a real certificate error is never fixed by downloading and installing a program from the website. If a page asks you to install something to fix a certificate, close it.
Which vulnerability should I patch?
Check Point doesn't name one. For OceanGate it only mentions a vulnerable internet-facing Linux server, and in one SilentDelivery case an XSS flaw on the compromised website. So the job is mainly hunting for compromise and keeping everything exposed to the internet up to date.
Is CopperDragon the same as Salt Typhoon?
Nobody has shown that publicly. FamousSparrow was previously linked to Salt Typhoon, but Check Point calls the relationship unclear, and in March 2025 ESET described FamousSparrow as a distinct cluster with only loose links to the others.
Sources
- Check Point Research – Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe (10 November 2026)
- ESET WeLiveSecurity – FamousSparrow and new SparrowDoor versions (26 March 2025)
- Trend Micro – Game of Emperor: Unveiling Long Term Earth Estries Cyber Intrusions (November 2024)
Spotted a mistake? Let us know and we will correct it openly.
Related
Actively exploited
BlackNevas ransomware wiped ESXi and backups after enabling SSH through vCenter Host Profiles
On 13 November 2026 Kaspersky GERT published its analysis of a BlackNevas ransomware intrusion that encrypted four ESXi hosts with every virtual machine on them, both vCenter appliances and the backup infrastructure. No VMware vulnerability was needed: credentials stolen from other systems and everyday vCenter features were enough. Here is how it unfolded, the indicators, and what to monitor.
Actively exploited
Attackers abuse GSocket for stealthy access to Linux servers
On 11 November 2026 Microsoft published an analysis of intrusions in which attackers, after breaking in through a vulnerable web application, install the legitimate open-source tool GSocket on Linux servers. The connection goes out through a shared relay network, so inbound firewall rules never see it, and the attackers keep access even after the original flaw is patched. The write-up includes paths, hashes, domains and hunting queries.
Critical
Firefox 160 fixes 99 flaws, 57 rated high and nine sandbox escapes - update ESR too
Mozilla shipped Firefox 160 on 10 November 2026, along with Firefox ESR 153.7 and 115.45. The Firefox 160 advisory alone lists 99 vulnerabilities, 57 of them rated high. Mozilla describes nine of those as sandbox escapes, meaning flaws that can break the isolation meant to keep a malicious page away from the operating system. There are no reports of exploitation so far. Here is what to update and how to check it across a fleet.