CriticalMalware
Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem
The Hacker News·Source published ·1 min read
What happened?
Three distinct threat activity clusters with shared infrastructure and malware code similarities have been observed targeting telecommunications providers, government organizations, military entities, research institutions, and critical infrastructure across Latin America, Asia, and Europe over the past year.
Key details
- Three China-linked espionage clusters share infrastructure and code through the Sparrow malware ecosystem.
- Check Point tracks the clusters as SilentDelivery, OceanGate, and DarkWire, linked by the Sparrow framework.
- The Sparrow framework is attributed to a developer codenamed CopperDragon supplying tools to multiple China-nexus actors.
- SilentDelivery uses watering hole attacks with fake certificate fix utilities to deliver SquadC or SparrowDoor variants.
- DarkWire targets Latin American telecoms and governments using CopperDoor and CopperDNS backdoors delivered via DLL sideloading.
Affected
- Telecommunications providers, government, military, research institutions, and critical infrastructure in Latin America, Asia, and Europe.
- Compromised websites in government, shipping, IT, and research sectors across Czech Republic, Germany, France, Taiwan, Nepal, Hong Kong, Indonesia, Egypt, and Philippines.
What to look for
- Heavily obfuscated JavaScript injected into legitimate websites using jsjiami obfuscation service.
- Fake Google Chrome SSL certificate warnings prompting users to install a "Certificate Fix" utility.
- Trojanized MSI installers masquerading as certificate repair utilities delivering SquadC or SparrowDoor.
- AnnobinDoor Go-based Linux backdoor with remote shell, SOCKS proxy, SSH tunneling, and port forwarding.
- SparrowShell modular Linux backdoor sharing code and infrastructure with Mélofée malware based on Reptile rootkit.
- Kernel rootkits and WinDivert drivers used to hide processes and manipulate network packets on Windows.
Summarised by SecOraLens from The Hacker News. Always read the original source before acting. How SecOraLens verifies advisories.