CopperDragon: Check Point ties three China-nexus intrusion sets to one Sparrow-framework supplier, among them SilentDelivery watering holes on government, shipping, IT and research sites that show a fake Chrome certificate warning (Czech Republic, Germany and France in its telemetry)

Check Point Research's year-long investigation groups three intrusion sets under one malware-supply entity it calls CopperDragon, a possible "digital quartermaster" for China-nexus actors that use the cross-platform Sparrow framework (FamousSparrow and Earth Estries among them); Check Point itself cautions that the use of the same backdoor or C2 infrastructure "does not necessarily mean" the same actor ran two intrusions, so this is a hypothesis (Check Point Research, 2026-11-10).

SilentDelivery, active since early 2026 against Europe and Asia, is the set nearest the constituency. Compromised government, shipping, IT and research websites, one through cross-site scripting in an unsanitised input field, carry obfuscated JavaScript that fingerprints the visitor and replaces the page with a language-localised fake Google Chrome SSL warning urging a "Certificate Fix" utility; the MSI, served from compromised cloud storage buckets, installs the new SquadC backdoor or a SparrowDoor variant (Check Point Research, 2026-11-10). SquadC can be set to run only while a browser process is alive, persists through a Run key named WindowsUpdateAssist, and offers file operations, command execution and screenshots. A second route is a spear-phishing RAR whose LNK abuses ftp.exe, with the same C2 (Check Point Research, 2026-11-10). Positive Technologies independently documented the same fake-certificate chain, with victims in Taiwan, Germany, Indonesia and the Czech Republic (Positive Technologies, 2026-08-21).

The other two sets show what follows an intrusion. OceanGate in Asia starts from an exploited internet-facing Linux server and moves through trojanised ssh and sshd binaries that log passwords, a Linux backdoor that can load a kernel rootkit, FRP and Chisel tunnels, a hidden local administrator account and an LSA security-package credential interceptor; recent SparrowDoor builds embed the WinDivert driver to share a service port such as 443. DarkWire against Latin American telecom and government bodies uses DLL sideloading of uncommon executables, SoftEther VPN renamed to system-process names, DNS MX tunnelling and WMI lateral movement (Check Point Research, 2026-11-10). No Swiss victim is named.

Triage: WinDivert is legitimate in VPN and firewall products, so the signal is a parent that is a sideloaded DLL or backdoor rather than the vendor's signed service; SoftEther is legitimate software, but not under a system-process name in a non-system path; a genuine Chrome SSL warning is never cleared by installing an MSI.