Research

Check Point Says One Toolmaker, CopperDragon, Arms Three China-Nexus Spy Campaigns. All 158 Indicators It Published Are in Our Feed. Here Is What to Block and What to Hunt For

Patrick Duggan · · 7 min read

Check Point Says One Toolmaker, CopperDragon, Arms Three China-Nexus Spy Campaigns. All 158 Indicators It Published Are in Our Feed. Here Is What to Block and What to Hunt For

If you run a telecom, a government network or anything in shipping or research, especially in Latin America, Asia or Europe, pull the indicator list from Check Point Research's November 10 report on CopperDragon into your blocklist and your endpoint search today. Then hunt for three things the list cannot catch: a fake Chrome "certificate error" page asking staff to install a "Certificate Fix", replaced ssh and sshd binaries on Linux servers, and a hidden local account named admin$ on Windows hosts. Every indicator Check Point published, 158 of them, is already in our public feed. Credit for every one of them belongs to Check Point.

What Check Point reported

The primary source is Check Point Research, "Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe", published November 10, 2026. We read it in full. Everything in this section is Check Point's account, not our observation.

  • Who: Check Point tracks an entity it calls CopperDragon as the possible developer and supplier, a "digital quartermaster", of the Sparrow malware framework (Windows and Linux). Check Point names FamousSparrow, Earth Estries, Tropic Trooper and UAT-9244 among the China-nexus actors that use it, and says the link between FamousSparrow and Salt Typhoon "remain[s] unclear". It also warns that shared malware or infrastructure "does not necessarily mean that two intrusions were conducted by the same actor."
  • The investigation: a year long, covering "several dozens of high-profile organizations" in Latin America, Asia and Europe, grouped into three clusters.
  • SilentDelivery (Europe and Asia, from early 2026): watering-hole attacks. The attackers compromised government, shipping and IT and research websites and injected JavaScript that replaced the page with a fake Google Chrome certificate warning in the site's language, with a button to install a "Certificate Fix" utility (CertFixer.msi). The download carried a new backdoor Check Point calls SquadC, or a SparrowDoor variant, pulled from compromised S3 buckets. SquadC persists through a Run registry key named WindowsUpdateAssist. Check Point's telemetry put targets in the Czech Republic, Germany, France, Taiwan, Nepal, Hong Kong and Indonesia. A spear-phishing archive, Strategi_AS_Referensi_April2026.rar, delivered the same backdoor using an LNK file that abuses ftp.exe. Check Point notes Positive Technologies also reported part of this cluster.
  • OceanGate (mainly Asia, 2025 to 2026): government and critical infrastructure. Entry through a vulnerable internet-facing Linux server (Check Point does not name the flaw), then two new Linux backdoors, AnnobinDoor (Go, WebSocket) and SparrowShell (the Linux sibling of SparrowDoor, with an optional kernel rootkit built from the open-source Reptile rootkit). The actor replaced ssh and sshd with versions that log passwords, used those credentials to move between Linux hosts, then guessed RDP passwords into Windows until an administrator account worked. On Windows: CopperAdu creates a hidden local administrator named admin$ with the password Admin@123456 and opens SMB on port 445 through a firewall rule named RasiUwpApp; CopperList inventories files; CopperLogger records keystrokes and clipboard; CopperLsa plants a malicious security package in LSASS to capture credentials. Some SparrowDoor builds embed the WinDivert driver to hide behind a legitimate service's port such as 443.
  • DarkWire (Latin America, from mid-2025, expanding): telecom operators and government, "including at least three major telecom providers in the region, as well as the foreign affairs and justice sectors." New backdoors CopperDoor (which ESET has analyzed as SparroWocky) and CopperDNS (tunnels over DNS MX queries), loaded through DLL sideloading by a loader Check Point calls CopperLoader, plus CopperProxy, PyProxy, an LSASS dumper called CopperLsass whose output is renamed 1.png, and SoftEther VPN renamed vmtoolsd.exe or csrss.exe. C2 servers listened on 443 with raw TCP inside TLS, often hosted in the victim's own country, some with certificate names that imitate the victim's domains. CopperDNS servers reused one certificate whose subject and issuer are both "CN=8.8.8.8", usually on port 6532.

What it means

The useful idea is the quartermaster. If one supplier arms several crews, tracking any one crew by its malware tells you less than it used to, and a detection for one tool family protects against several groups at once. The second lesson is the entry points: an unpatched internet-facing Linux box, a trusted website, a fake certificate prompt. None of those is exotic, and the Linux side is where Check Point says public reporting has been thin.

What to do

  1. Block and search. Load Check Point's 93 IP addresses and 14 domains into your firewall, proxy and DNS filtering, and 49 of its 51 SHA-256 file hashes into your endpoint tool. Leave out the FRP hash beginning 3e4eef1a and the SoftEther hash beginning 4f9d9a6c: both are unmodified official builds of public tools (see "What is not known" below), so blocking them flags every legitimate install of those versions. Search 90 days of DNS, proxy and firewall logs for any contact, not just new contact. The domains include typo lookalikes of Microsoft and Windows Defender names (microsfot.vip, microscoft.vip, windowsdefender.it.com, windowsupdates.us, microupdate.me, windefender.net) that are easy to miss by eye.
  2. Teach the certificate trick. A website that suddenly says you must install a certificate fixer is an attack, every time. Browsers never ask you to install software to fix a certificate error. Block MSI downloads from S3 and similar storage for users who do not need them.
  3. Check your Linux servers' SSH. Compare the hashes of /usr/bin/ssh and /usr/sbin/sshd against your distribution's package manifest (rpm -V openssh or debsums on Debian systems). A mismatch with no package update behind it means rotate every credential used on that host.
  4. Check Windows for the planted admin. Look for a local account named admin$, a firewall rule named RasiUwpApp, a Run key named WindowsUpdateAssist, LocalAccountTokenFilterPolicy set to 1, and new security packages registered with LSASS. Look for vmtoolsd.exe or csrss.exe running from an unusual folder; Check Point lists C:\ProgramData\USOShared, C:\ProgramData\Waves, C:\ProgramData\vmware\logs and C:\Windows\debug among the paths used.
  5. Watch DNS for MX lookups from workstations. Ordinary PCs rarely ask for mail-exchanger records. Bursts of MX queries are what CopperDNS tunneling looks like.
  6. Patch the edge. OceanGate started on an internet-facing Linux server. Check Point does not say which flaw, so the general rule applies: inventory what you expose and patch it on the vendor's clock.

What is not known

Which Linux vulnerability opened OceanGate, which websites were compromised for SilentDelivery, and who the victims are; Check Point does not name them. How many organizations were hit in total beyond "several dozens". Whether CopperDragon is a separate entity or a shared tooling pool; Check Point says "possible" and "may". Two of the hashes are not malware builds, and we checked. The FRP hash (3e4eef1a…, frpc, OceanGate) is byte-identical to the frpc in the official FRP v0.67.0 linux_amd64 release on GitHub: we downloaded that release, its archive matched the project's published SHA-256 checksum, and the frpc inside hashed to exactly 3e4eef1a… at the same size, 16,203,960 bytes. The SoftEther hash (4f9d9a6c…, vmtoolsd.exe, DarkWire) carries a valid code signature from SoftEther Corporation, product SoftEther VPN version 4.43.0.9799, original name vpnbridge_x64.exe, per VirusTotal; that is the stock SoftEther VPN Bridge 4.43 build 9799. Check Point is right that the attackers used them. But a hash match on either one also fires on every legitimate copy of that version, so hunt for these by where the file sits and what it is named (vmtoolsd.exe or csrss.exe outside their normal folders, frpc on a server nobody installed it on), not by hash.

How we know, and how we checked

Feed state. We looked up every indicator in Check Point's appendix, 158 unique values (51 hashes, 14 domains, 93 IP addresses; three IPs appear in both the SilentDelivery and OceanGate lists), against our corpus with an exact-match lookup. All 158 were already held, and all 158 appear in our published feed files: the 93 IPs in ips.csv, the 14 domains in domains.csv and the 51 hashes in hashes.csv, as of November 11. They arrived through our vendor-report lane (source vendor-blog/checkpoint) on November 10 at 14:17 UTC, after the report was published, at confidence 80 for hashes, 75 for IPs and 70 for domains. The IPs and domains are therefore below our own edge shield's blocking floor of 80, and a subscriber pulling ips.csv with min_confidence=80 will not get them; the default pull does. We added nothing new, because nothing was missing.

Update, November 11, 2026, later the same day. Those 158 records carried no actor or malware family, so a search of our feed for CopperDragon found none of them, and the IP and domain records would have aged out of the default seven-day ips.csv window. We re-ingested 156 of them with Check Point's attribution (actor CopperDragon, the malware family and cluster for each, the report as reference) at confidence 80 under the source manual-batch-copperdragon-2026-11, which keeps them in the file past the seven-day window and puts the IPs and domains at our edge shield's blocking floor. The two we left out are the FRP and SoftEther hashes above, which are stock public binaries; we are taking both out of our hash feed.

Who else had some of them first. Some of these indicators were in our corpus before Check Point published, all through third-party feeds, which is distribution, not detection. Eleven of the 51 hashes were in MalwareBazaar's public sample feed between August 26 and September 27, labelled only as generic malware samples, and three more arrived there on November 11. Five OceanGate IP addresses (216.238.123.242, 64.190.113.170, 154.223.21.194, 154.205.154.82, 154.205.154.70) were already in our corpus from Cisco Talos's UAT-9244 reporting in March, which we covered in our post on UAT-9244 and South American telecoms. One DarkWire IP, 77.111.101.227, was shared by the TweetFeed community feed in July. That overlap is corroboration of Check Point's link between these clusters and UAT-9244. It is not a lead of ours, and we make no claim to one. We have been wrong about that with FamousSparrow before, and we corrected it.

Edge check. We checked each of the 93 IP addresses against our own edge instruments for the 30 days from October 12 to November 11: 259,315 blocked requests at our edge and about 45,900 decoy (canary) hits, plus the origin honeypot. None of the 93 addresses appears in any of them. That is a measurement of traffic to our own websites only. These servers are command-and-control for targeted intrusions, not internet-wide scanners, so silence at our edge says nothing about whether they are active elsewhere. The watering-hole trick, the SSH swap and the DNS tunneling happen on victims' networks, which our edge cannot see.

Sources

Check Point Research, "Not All That Glitters Is Gold: Tracking CopperDragon's Sparrow Framework Around the Globe," November 10, 2026, read in full including its indicator appendix. Press coverage: The Hacker News, "Three China-Nexus Espionage Campaigns" report, November 2026; we did not rely on it for any fact here. Check Point's report itself cites ESET (SparroWocky), Positive Technologies (part of SilentDelivery) and Cisco Talos (TernDoor certificates). Indicator overlap from MalwareBazaar, TweetFeed and Cisco Talos's March 2026 UAT-9244 reporting as held in our corpus.

How do AI models see YOUR brand?

AIPM has audited 250+ domains. 15 seconds. Free while still in beta.

Audit your site now → aipmsec.com

Was this useful? Thirty seconds, no cookies, no tracking, no third parties, your address hashed and never stored. The question lives here: https://analytics.dugganusa.com/nps.html#post=copperdragon-sparrow-framework-three-clusters-check-point