Hunt: Check Point ties FamousSparrow-family intrusions to one toolmaker, 'CopperDragon', from fake Chrome certificate errors to trojanized sshd and DNS-tunnel backdoors

vendor research (Check Point Research, Nov 10, 2026); CopperDragon as a shared supplier is Check Point's assessment2026-11-11 7:44 AM ET

Web side: pages that suddenly show a localized Chrome certificate warning with an 'Install certificate' button; injected jsjiami-obfuscated JavaScript calling /image-check?t=, /report-url and /register-ip; MSIs downloaded from S3 buckets. SquadC persists under the Run key WindowsUpdateAssist.
Linux: Go backdoor annobinagent (WebSocket by default), SparrowShell with a modified Reptile rootkit, and replaced ssh/sshd binaries that log credentials; FRP and Chisel tunnels. Verify OpenSSH binaries against package hashes.
Windows: hidden local admin admin$ with LocalAccountTokenFilterPolicy=1 and a firewall rule RasiUwpApp opening 445; custom LSA security packages in LSASS; LSASS dumps renamed 1.png; firewall rule ss1 for a SOCKS proxy; SoftEther renamed vmtoolsd.exe/csrss.exe; DLL sideloading via ncptrcw.exe, fsptool.exe, vlc.exe, gethwid.exe, zCrashReport64.exe.
Network: SparrowDoor variants that use WinDivert to hijack a legitimate port such as 443; CopperDNS tunneling over MX queries; C2 TLS certificates with CN=8.8.8.8 or 'Internet Widgits Pty Ltd' defaults.
Full hash, domain and IP lists are in the report.