---
title: Hunt: Check Point ties FamousSparrow-family intrusions to one toolmaker, 'CopperDragon', from fake Chrome certificate errors to trojanized sshd and DNS-tunnel backdoors | ctxsec
url: https://ctxsec.com/items/hunt-check-point-copperdragon-sparrow-framework-silentdelivery-fake-cert-fix-oceangate-darkwire
description: "Check Point says a year of intrusions against telecoms, governments, militaries and research bodies in Latin America, Asia and Europe share the Sparrow malware framework, and it tracks the likely developer and supplier as CopperDragon, serving China-nexus actors such as FamousSparrow, Earth Estries, TropicTrooper and UAT-9244. It describes three clusters: SilentDelivery (watering holes on government, shipping and IT sites showing a fake Chrome certificate error that pushes a 'CertFixer.msi'), OceanGate (internet-facing Linux first, then Windows) and DarkWire (Latin American telecoms, with new CopperDoor and CopperDNS backdoors)."
status: "vendor research (Check Point Research, Nov 10, 2026); CopperDragon as a shared supplier is Check Point's assessment"
published: 2026-11-11
---

> Check Point says a year of intrusions against telecoms, governments, militaries and research bodies in Latin America, Asia and Europe share the Sparrow malware framework, and it tracks the likely developer and supplier as CopperDragon, serving China-nexus actors such as FamousSparrow, Earth Estries, TropicTrooper and UAT-9244. It describes three clusters: SilentDelivery (watering holes on government, shipping and IT sites showing a fake Chrome certificate error that pushes a 'CertFixer.msi'), OceanGate (internet-facing Linux first, then Windows) and DarkWire (Latin American telecoms, with new CopperDoor and CopperDNS backdoors).

[← Threat Hunting](/hunting) · [markdown](/items/hunt-check-point-copperdragon-sparrow-framework-silentdelivery-fake-cert-fix-oceangate-darkwire.md)

vendor research (Check Point Research, Nov 10, 2026); CopperDragon as a shared supplier is Check Point's assessment

2026-11-11 7:44 AM ET

### Hunt: Check Point ties FamousSparrow-family intrusions to one toolmaker, 'CopperDragon', from fake Chrome certificate errors to trojanized sshd and DNS-tunnel backdoors

- **Web side:** pages that suddenly show a localized Chrome certificate warning with an 'Install certificate' button; injected `jsjiami`-obfuscated JavaScript calling `/image-check?t=`, `/report-url` and `/register-ip`; MSIs downloaded from S3 buckets. SquadC persists under the Run key `WindowsUpdateAssist`.
- **Linux:** Go backdoor `annobinagent` (WebSocket by default), SparrowShell with a modified Reptile rootkit, and replaced `ssh`/`sshd` binaries that log credentials; FRP and Chisel tunnels. Verify OpenSSH binaries against package hashes.
- **Windows:** hidden local admin `admin$` with `LocalAccountTokenFilterPolicy=1` and a firewall rule `RasiUwpApp` opening 445; custom LSA security packages in LSASS; LSASS dumps renamed `1.png`; firewall rule `ss1` for a SOCKS proxy; SoftEther renamed `vmtoolsd.exe`/`csrss.exe`; DLL sideloading via `ncptrcw.exe`, `fsptool.exe`, `vlc.exe`, `gethwid.exe`, `zCrashReport64.exe`.
- **Network:** SparrowDoor variants that use WinDivert to hijack a legitimate port such as 443; CopperDNS tunneling over MX queries; C2 TLS certificates with CN=8.8.8.8 or 'Internet Widgits Pty Ltd' defaults.
- Full hash, domain and IP lists are in the report.

Sources: [Check Point Research: Tracking CopperDragon's Sparrow Framework Around the Globe (Nov 10, 2026)](https://research.checkpoint.com/2026/not-all-that-glitters-is-gold-tracking-copperdragons-sparrow-framework-around-the-globe/)