Check Point Research linked three China-nexus espionage clusters to the CopperDragon malware ecosystem. In its SilentDelivery campaign, attackers compromised legitimate websites and replaced them with fake Chrome certificate warnings that urged selected visitors to install a malicious “Certificate Fix” utility. The same operation also used a targeted archive disguised as an Indonesian-language reference document to deliver malware.
Check Point Research linked three China-nexus espionage clusters to a shared malware ecosystem attributed to CopperDragon, assessed as a possible developer and supplier of the Sparrow malware framework. In the SilentDelivery cluster, attackers compromised legitimate websites belonging to government, shipping, and IT or research organizations. Rather than hosting malware directly, they injected obfuscated JavaScript that replaced a visitor's entire browsing session with a fake Google Chrome SSL certificate warning, localized to match the site's language. Visitors were fingerprinted by IP address and geolocation, allowing the attackers to show the fake warning only to selected targets rather than to every visitor.
The counterfeit warning told visitors their connection had a certificate problem and urged them to install a "Certificate Fix" utility. Clicking the install button triggered a report back to the attacker's infrastructure and downloaded an MSI package from an external storage bucket. That package delivered either a previously undocumented backdoor called SquadC or a variant of SparrowDoor, giving the attackers a foothold on the victim's device (T1189, T1204.002).
Alongside the website compromise, researchers identified a separate spear-phishing archive, Strategi_AS_Referensi_April2026.rar, uploaded to VirusTotal from Indonesia. Inside was a file presented as a Word document but actually an LNK shortcut using a double extension (.docx.lnk). Executing it ran command-line instructions that abused the ftp.exe living-off-the-land binary to extract and launch the SquadC backdoor, while showing the victim an empty decoy document (T1566.001, T1059.003, T1036).
This activity worked because it relied on signals people are trained to trust: a familiar browser warning and a seemingly ordinary reference document. Compromising already-legitimate websites meant visitors had no reason to doubt the page's authenticity, and selective targeting by IP and geolocation reduced the chance of early detection. The spear-phishing lure leaned on a mundane business file name to lower suspicion before the double extension revealed its true nature.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
SilentDelivery is a cluster in which attackers compromised legitimate government, shipping, and IT/research websites and injected fake Google Chrome SSL certificate warnings to trick selected visitors into installing a malicious utility.
Installing the fake utility delivered either the SquadC or SparrowDoor backdoor onto the victim's machine.
The malicious website code fingerprinted visitors by IP address and geolocation, allowing attackers to selectively display the fake certificate warning to specific targets.
Researchers found a spear-phishing archive named Strategi_AS_Referensi_April2026.rar that used a document disguised as an LNK file to deliver the same SquadC backdoor.
A real website can show you a fake Chrome warning. In SilentDelivery, compromised government, shipping, and research sites showed selected visitors an ‘Install certificate’ button. Click it, and a ‘Certificate Fix’ MSI downloads from an external S3 bucket, delivering malware. That’s the tell: Chrome doesn’t repair certificates with a website’s installer. The page may even look normal for coworkers, its code checks your location before showing the warning. If a website offers a certificate fix, don’t install it. Report the page to IT.
ESET reports that Russia-aligned group UAC-0099 is using spearphishing emails with malicious links to deliver a downloader called MATCHBOIL. The attack relies on tricking a person into manually running a downloaded VBScript, which then fetches and installs further malware and sets up persistence…
Cisco Talos reports a real campaign by a Russian-speaking group (UAT-11795) targeting users in the U.S. and Europe with trojanized installers for popular tools like Zoom, Webex, and MobaXterm. Victims are socially engineered via a “ClickFix” style trick into running a command that silently…
Microsoft reports Russia-linked Star Blizzard sent fake event invitations and other business notices to trick targets into opening disguised files that install a Windows backdoor. The campaigns targeted Ukraine-linked people and organizations and hit 100+ organizations, mainly in the U.S. and U.K.,…
South Korean agencies warned that a state-backed hacking group is actively targeting citizens and businesses using job-themed phishing emails and “watering hole” attacks on legitimate websites. The phishing lures include fake job applicants sending resume links and impersonated recruiters sending…
China-linked espionage campaigns used compromised websites to show selected visitors a fake Chrome certificate warning and persuade them to install a “Certificate Fix” utility. The same malware was also delivered to Indonesian organizations in phishing emails using a shortcut file disguised as a…
Russia-aligned Gorbag has targeted Ukrainian government, justice, defense, and logistics organizations with convincing spearphishing emails. The group used a compromised local-government email account to send a fake administrative-fines notice with a malicious Excel attachment, then shifted to…
