What happened
Check Point Research published a report on 10 November 2026 linking three espionage clusters, SilentDelivery, OceanGate and DarkWire, through a shared malware ecosystem called Sparrow. The entity behind that framework is tracked as CopperDragon, assessed to be a digital quartermaster that supplies tools to China-nexus actors including FamousSparrow, Earth Estries, TropicTrooper and UAT-9244.
The campaigns targeted telecommunications providers, government organisations, military entities, research institutions and critical infrastructure across Latin America, Asia and Europe over the past year. Each cluster used its own initial access technique and toolset, which is why they first looked like separate operations.
The cluster most relevant to admins tonight is SilentDelivery. Attackers inject obfuscated JavaScript into legitimate websites their targets visit. A visitor on Windows is shown a fake Google Chrome SSL certificate warning, written in the site's own language, that tells them to install a "Certificate Fix" utility. That installer is a trojanized MSI that delivers either the SquadC backdoor or a variant of SparrowDoor. Check Point is clear that this does not exploit a Chrome vulnerability: the chain relies on the user running the installer.
Timeline
- Mid 2025: DarkWire targets telecoms and government in Latin America using CopperDoor and CopperDNS.
- 2025 to 2026: OceanGate compromises internet-facing Linux servers, then moves into Windows.
- Early 2026: SilentDelivery watering-hole activity begins, focused on Europe and Asia.
- August 2026: Positive Technologies reports part of the campaign, including Egypt and the Philippines.
- 10 November 2026: Check Point publishes the report linking all three via Sparrow.
Am I affected?
You are in scope if any of the following apply:
- Staff browse sector sites in government, shipping, IT or research in the Czech Republic, Germany, France, Taiwan, Nepal, Hong Kong or Indonesia.
- You run internet-facing Linux servers that could be used as an entry point into Windows, as in OceanGate.
- You are a telecoms provider or government body in Latin America.
SilentDelivery is highly selective. The JavaScript fingerprints visitors by IP and geolocation before deciding to show the warning, and the fake page vanishes on later visits to make the "fix" look successful. That is designed to discourage reporting, so absence of a visible warning is not reassurance.
What to do now
- Warn staff: Chrome never prompts you to install a "Certificate Fix" or repair utility. Any such download should be reported, not run.
- Block the known domains and IPs: microsfot[.]vip, microscoft[.]vip, aistei[.]com, astorialaza[.]com, and the IPs 135.136.135.54, 103.141.235.123, 109.205.195.131, 158.255.213.189, 165.154.227.16, 45.197.12.11, 91.210.164.5. Re-fang only inside controlled tools.
- Load the SHA-256 installer and loader hashes from the IoC list into your EDR and SIEM.
- Review internet-facing Linux servers for credential theft and modified SSH components, and check for RDP brute-force attempts against administrator accounts.
- Hunt for persistence via Registry Run keys masquerading as a Windows update assistant.
How to hunt
- LNK and ftp.exe: look for LNK files disguised as PDFs that abuse the legitimate ftp.exe to run a batch script and sideload a DLL. This was seen in phishing against Indonesian organisations.
- DLL sideloading: review processes loading unexpected DLLs from writable paths.
- Passive backdoor traffic: OceanGate abused WinDivert drivers to intercept packets at the kernel level, listening internally on a high port such as 49628 while receiving connections through 443. Check for unexpected high-port listeners and unusual packet rewriting on hosts exposing 443.
- DNS channel: DarkWire's CopperDNS tunnels command traffic through DNS MX queries. Review MX query volumes from endpoints.
- Credential theft tooling: watch for collection of NTLM and Kerberos hashes, keylogging and clipboard monitoring.
What does not help
Treating the warning as a Chrome bug and chasing a browser patch does not help: there is no Chrome vulnerability here. The infection needs a user to execute the installer. Equally, assuming one group is behind everything is a mistake. Check Point warns that shared backdoors or servers do not prove a single operator.
Sources
- Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem, The Hacker News, 10 Nov
- China-Linked Hackers Use Fake Chrome Certificate Warnings to Infect Victims With Sparrow Backdoor, Cyber Security News, 11 Nov
- Not All That Glitters Is Gold: Tracking CopperDragon’s Sparrow Framework Around the Globe, Check Point Research, 10 Nov
