Somebody Is Arming China’s Spies From Panama to Prague

The error page looks like Chrome's own. It appears in the language of the website it hijacks, including Czech on at least one compromised site. It blocks the page behind it and tells the visitor to install a certificate fix. The fix is a backdoor. Once it reports in, the warning never appears for that visitor again, and the website loads as if nothing happened.

Check Point Research found the trap on compromised government, shipping, IT, and research websites across Europe and Asia. On November 10, it tied the campaign to two others. One moves from Linux servers into Windows networks across Asia, and the other sits inside Latin American telecommunications carriers and ministries.

The three campaigns share the Sparrow malware framework, and Check Point tracks the entity behind it as CopperDragon, "a potential digital quartermaster supporting China-nexus threat actors." ESET, which has tracked FamousSparrow since 2021, attributes the Latin American campaign to that single threat actor and calls it the only known user of SparrowDoor. Two of the teams most experienced with this malware now read overlapping evidence in opposite directions.

The disagreement decides who defenders and governments go after. A single adversary with regional teams can be tracked as one. A supplier issuing tools to several adversaries opens the way to sanctions and indictments against a company, and its tools will keep reaching customers nobody has named yet. The evidence favors a shared supplier, though it says far less than the new name implies about what kind of entity the supplier is.

Warnings in the Visitor's Language

SilentDelivery, the newest of the three campaigns, began in early 2026 with watering-hole attacks. The threat actor compromised the websites, in one case through cross-site scripting on an unsanitized input field, and injected JavaScript obfuscated with the public jsjiami service. The fix offered by the counterfeit error, an MSI installer named CertFixer.msi, came from Amazon S3 buckets Check Point believes the threat actor also compromised.

The selection happens on the server. Before altering anything, the script contacts the command-and-control server, which fingerprints the visitor by IP address and geolocation. When the server answers, the page loads normally. When it stays silent, the script hijacks the page. A researcher checking a reported site from an uninteresting network would most likely see nothing wrong.

The payload is SquadC, a basic backdoor with sandbox checks and an option to run only while a browser is open, which Check Point treats as an initial foothold. Positive Technologies published the same backdoor in August as SquawkDoor, and the two reports share installer and loader hashes. Positive Technologies places the compromised-website chains in Taiwan, Germany, Indonesia, and the Czech Republic, with lures in Traditional Chinese, German, and Czech. One compromised platform belonged to an international food-security research organization, whose readers and authors Positive Technologies believes were the targets.

Check Point's telemetry adds France, Nepal, and Hong Kong to the victim countries. Its attribution of SilentDelivery rests on three observations. Some installers delivered a SparrowDoor variant instead of SquadC. The DLL loading SquadC previously appeared in FamousSparrow's toolset. The command-and-control servers share layout, exposed services, response banners, and a reused TLS certificate. That certificate names a VeriSign code-signing authority as its subject and McAfee as its issuer, and it expired in April 2024.

Several victim countries sit at points of friction with Beijing, though no reporting ties a named victim to these events, so they serve as background rather than explanation. The Czech government attributed a campaign against its foreign ministry to China in May 2025, most likely through JUDGMENT PANDA (aka APT31), and later co-sealed the allied advisory on Salt Typhoon's contractors. Nepal gave a new party a single-party majority in March 2026 on a promise of a "balanced and independent" foreign policy, while China's Belt and Road projects there have made "glacial" progress.

Spear-phishing reached Indonesia through an archive named Strategi_AS_Referensi_April2026.rar, which used an LNK file abusing ftp.exe to unpack SquadC. In Indonesian, "AS" is the standard abbreviation for the United States, so I read the file name as a reference document on US strategy for April 2026. Neither vendor translates it. Indonesia signed a reciprocal trade agreement with Washington in February, and President Prabowo Subianto describes his country as a "bridge" between the great powers. A file name shows what the threat actor expected a reader to open, a thematic link rather than proof of tasking.

The same lure exposed a person. Positive Technologies found the hostname desktop-k196dpf in the LNK metadata and matched it to a Hack The Box walkthrough by a penetration tester using the handle "imawuya," who had also written online about gaining unauthorized access to a local dating app. Positive Technologies assesses with high confidence the lure was created and tested on the same computer, and judges its owner a likely member of the threat actor's team but not a central figure.

One shared workstation proves little about the wider workforce. The match fits a member of the threat actor's team, a contractor, a malware tester, or a reused development environment. It is consistent with recruitment from China's civilian security community, where offensive skills are taught and published in the open, without establishing it. I examined a related pattern when MI5 warned the Ministry of State Security was funding UK-linked academics to improve its espionage tradecraft.

Linux First, Windows Next

OceanGate, active through 2025 and 2026 against government organizations and critical infrastructure mainly in Asia, follows a longer path. It began with exploitation of a vulnerable internet-facing Linux server. Check Point names neither the product nor the vulnerability, so both remain unknown in public. The first implant was AnnobinDoor, a Go backdoor packed with UPX and using WebSocket by default, which turned the server into a remote shell and an internal pivot.

The second Linux implant, SparrowShell, carries the widest consequences. Check Point describes it as the Linux counterpart of SparrowDoor, sharing command-and-control servers, RC4 keys, command-line arguments, and a plugin architecture. It can load a modified Reptile rootkit into the kernel to hide files, processes, and network connections. Its code and certificate habits match Melofee, a Linux implant ExaTrack linked in 2023 through infrastructure to WICKED PANDA (aka APT41) and Earth Berberoka. Check Point now assesses CopperDragon helps maintain and supply Melofee variants.

A few days later, the threat actor replaced the server's SSH client and daemon with Trojanized builds logging credentials, then repeated the swap on each Linux host the stolen credentials opened. FRP, Chisel, and an open-source Python port scanner extended its reach. From Linux, it tried different passwords over RDP against Windows machines until an administrator account worked, possibly using credentials harvested earlier. It then deployed a set of single-purpose tools and, last, a SparrowDoor variant.

CopperAdu creates a hidden local administrator named admin$ with the hardcoded password "Admin@123456," sets LocalAccountTokenFilterPolicy to preserve remote administrative rights, and opens SMB through a firewall rule named "RasiUwpApp." CopperList inventories user files, then compresses and stages the listing for exfiltration. CopperLogger records keystrokes, clipboard contents, and window titles through the Raw Input interface. CopperLsa installs a custom security package inside LSASS to capture NTLM and Kerberos credentials as users authenticate.

The most evasive component is a passive SparrowDoor variant carrying the legitimate WinDivert packet driver. It opens no new port. It watches inbound traffic from one source address to a legitimate service, such as a web server on port 443, and rewrites those packets to an internal listening port. Replies are rewritten to appear to come from the legitimate service. Connections lacking the backdoor's magic value pass through to the real service, so port scans and firewall reviews see only what the organization meant to expose.

Carriers and Ministries in Latin America

DarkWire, identified in mid-2025, targets at least three major telecommunications providers in Latin America, along with the foreign affairs and justice sectors, and Check Point says recent intrusions suggest expansion beyond the region. Its main implants, CopperDoor and CopperDNS, run in memory through a reflective loader Check Point calls CopperLoader. The loader is sideloaded behind uncommon executables such as ncptrcw.exe, fsptool.exe, gethwid.exe, and zCrashReport64.exe. CopperDNS tunnels command-and-control traffic through DNS MX queries. A credential tool named CopperLsass dumps LSASS memory, encrypts the dump, and renames it 1.png before exfiltration.

The infrastructure is built to look local. CopperDoor servers spread across several hosting providers and speak raw TCP wrapped in TLS on port 443, some presenting certificates whose common names imitate the victim's own domain. Most servers sat in Latin America, often in the victim's country. Check Point found no direct code similarity between DarkWire tools and the rest of the framework beyond design patterns. Its link rests on one domain, amelicen[.]com, previously reported as SparrowDoor infrastructure, and on VirusTotal submitters uploading SparrowDoor and DarkWire files around the same time.

ESET supplies the stronger evidence. CopperDoor is the backdoor ESET published in September as SparroWocky. ESET attributes SparroWocky to FamousSparrow with high confidence, because SparrowDoor itself deployed it in early intrusions.

ESET's published command-and-control addresses overlap Check Point's DarkWire list, including 216.238.110[.]120, 38.60.241[.]65, and 149.104.87[.]228. ESET says FamousSparrow gained access by exploiting publicly reachable Exchange servers. Its researcher Alexandre Côté Cyr told The Hacker News DarkWire's tooling, infrastructure, and victimology "overlap with FamousSparrow."

ESET's victim list explains the timing. From mid-2025 into 2026, 90 percent of FamousSparrow's targets in ESET telemetry sat in Latin America, including government entities in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela. ESET reads the shift as "China's reaction to various recent US initiatives in the region." One Panamanian target is involved in the dispute over two canal ports a Hong Kong company operated. Panama's Supreme Court ruled CK Hutchison's concessions unconstitutional in January, and the state took over the terminals in February.

Two entries on ESET's list deserve more attention than they have received. Venezuela was a Chinese partner when US forces seized Nicolás Maduro in Caracas on January 3, 2026, and the campaign spans the months before and after the raid. Puerto Rico is a US territory, and the reopened Naval Station Roosevelt Roads supported the Caribbean buildup preceding it. ESET neither dates the intrusions by country nor names the Puerto Rican entities, so I hold at low confidence any link between the Puerto Rico targeting and the military buildup.

Telecommunications providers give the deepest access. According to an August 2025 allied advisory, China-nexus telecom intrusions give Chinese intelligence "the capability to identify and track their targets' communications and movements around the world." Carrier access in Latin America can reach the calls and locations of officials negotiating with Washington, and its larger value is the map.

Call records show who speaks to whom, when a relationship becomes active, and which foreign numbers enter the network. They can expose the intermediary between a minister and an American official even when the conversation itself is encrypted, and they build the next target list. I assess with moderate confidence the Latin American collection serves Beijing's effort to anticipate how regional governments respond to US pressure. Other Chinese customers could exploit the same access for their own ends, from tracking dissidents to contingency planning.

Supplier or Single Adversary

Check Point's quartermaster finding rests on tools and infrastructure recurring across campaigns with different targets, access methods, and pace. ESET itself reached for a quartermaster in March 2025, preferring "a shared third party, such as a digital quartermaster," to treating FamousSparrow, GhostEmperor, and Earth Estries as one threat actor. Trend Micro saw Earth Estries infrastructure "managed by different teams" and suggested "shared tools from malware-as-a-service providers." Talos assesses with high confidence UAT-9244 "closely overlaps" with FamousSparrow and PIRATE PANDA (aka Tropic Trooper). Four hypotheses fit this evidence, and each predicts something different.

Hypothesis 1, A Commercial Quartermaster

A company develops the Sparrow framework and provisions infrastructure for several state customers, the way i-Soon sold stolen data to at least 43 Ministry of State Security and Ministry of Public Security bureaus. The US Treasury sanctioned Sichuan Juxinhe Network Technology in January 2025 for direct involvement in Salt Typhoon's telecom intrusions. In August 2025, thirteen countries named it and two other companies as providers of cyber-related services to Chinese intelligence.

A year later, the Justice Department seized infrastructure belonging to a Nanjing company selling scanning and obfuscation services to both the MSS and the PLA. Such a supplier need not serve one plan, because the Justice Department says i-Soon also hacked on its own initiative and sold the results afterward. This hypothesis predicts Sparrow tools surfacing with new customers and divergent targeting.

Hypothesis 2, One Adversary With Regional Teams

FamousSparrow, or an organization above it, runs separate teams for Asia, Europe, and Latin America, each with its own preferred implant. ESET's position is more internally consistent than it first appears. Its quartermaster idea explains loose links between FamousSparrow and other clusters, while SparrowDoor itself stays exclusive to one threat actor. ESET also found two SparrowDoor versions apparently "being developed in parallel," with HemiGate as an earlier step in the same evolution, the pattern of one organization running several development lines.

The regional shift fits a single adversary taking new orders. FamousSparrow moved almost entirely to Latin America in July 2025 and introduced SparroWocky a month later, and ESET says it cannot tell whether the focus reflects "a formal, geographical mandate" or temporary circumstances. Trend's "different teams" managing Earth Estries infrastructure fit internal divisions as easily as separate customers. This hypothesis predicts consistent working hours, shared exploitation habits such as Exchange, and collection priorities moving between regions on command.

Hypothesis 3, A State Development Center

An office inside a Chinese intelligence or military service builds the tools and stands up infrastructure for several operational teams. China's military reorganized around exactly this kind of capability in April 2024, when Xi Jinping dissolved the Strategic Support Force and raised its network systems department into a Cyberspace Force charged with offensive operations. A state center would leave the same artifacts as a commercial supplier while leaving no company to designate.

The quality of the tradecraft offers a weak discriminator. A disciplined state center should reuse fewer careless artifacts, yet the Sparrow infrastructure kept long-expired certificates in service for years, and Positive Technologies found SquadC samples still carrying a localhost address and placeholder values from testing. A lure built on a penetration tester's personal workstation points the same way. These habits lean toward contractors over a central office, though careless engineers exist in every service, and only a leak, an indictment, or a government disclosure is likely to settle it.

Hypothesis 4, Access as the Product

The supplier may sell footholds as well as malware. In October 2025, Trend Micro documented what it calls "Premier Pass-as-a-Service," with Earth Estries acting as an access broker for Earth Naga, the threat actor CrowdStrike tracks as ETHEREAL PANDA (aka Flax Typhoon). Earth Estries entered the victim with CrowDoor, which Trend calls a new variant of SparrowDoor, and ShadowPad tied to Earth Naga later arrived through a CrowDoor network session. The Sparrow family has already served as a broker's entry tool.

This reading gives ESET's strongest evidence a second meaning. SparrowDoor installing SparroWocky can mark one team upgrading its own implant, or a handoff from an access team to a collection team. OceanGate's chain, from a Linux foothold to hidden administrator accounts, credential capture, and a passive backdoor, builds a position a customer could inherit. Trend also found both threat actors separately inside one telecommunications provider in Asia and another in a NATO country. This hypothesis predicts different implants and collection priorities appearing inside the same victims over time.

Weighing the Evidence

The evidence behind these hypotheses does not carry equal weight. The strongest links are SparrowDoor installing SparroWocky, shared command-and-control servers, and the RC4 keys SparrowShell shares with SparrowDoor. A reused loader and one TLS certificate spanning SilentDelivery and OceanGate sit in the middle. The weakest are OpenSSL default fields, the 8.8.8.8 common name, VirusTotal upload timing, and a single shared address, which generate leads without carrying attribution on their own.

SparroWocky itself shows why the tiers matter. Its first samples carry the opening stanza of Lewis Carroll's "Jabberwocky," which ESET traced to cipher test vectors in the Mbed TLS library compiled into the backdoor. A string that distinctive looks like a signature, and it arrived with borrowed code. The 8.8.8.8 certificate habit, seen on TernDoor servers in 2022 and CopperDNS servers in 2025, suggests a shared provisioning routine, though it cannot tell a contractor from a state development unit.

The strongest tier establishes one lineage of tools, and the middle tier ties Check Point's campaigns to one another. Adding Talos's overlap finding and Trend's separate infrastructure teams, I assess with moderate confidence a shared development and provisioning function serves more than one China-nexus intrusion team. I hold at low confidence the function is a separate company rather than a unit inside one intelligence organization, and access brokering cannot be excluded.

The Melofee link, if it holds, extends the same supply toward infrastructure ExaTrack tied to WICKED PANDA. ESET's view remains the strongest counterargument, and Check Point's clusters could collapse into one adversary if it prevails.

Reading the Researchers

Every account of this threat actor reflects its author's customers. Check Point lists victim countries "based on Check Point telemetry." Positive Technologies partly relied on sandbox uploads from Nepal and the Philippines, which show where files surfaced rather than where intrusions occurred. ESET's 90 percent figure counts targets in ESET telemetry. No vendor sees the tasking inside Chinese services, and each sees only its own slice of the victims.

Positive Technologies deserves particular scrutiny. The US Treasury sanctioned the firm in April 2021, describing it as supporting Russian government clients including the FSB and hosting conventions used as FSB and GRU recruiting events. Its report calls FamousSparrow "an East Asian threat group" and repeats the Salt Typhoon equivalence ESET rejects. It also notes one shared address, an overlap it calls limited to infrastructure, with Space Pirates (aka UAT-8302), a cluster Positive Technologies documented attacking Russia's public sector and aerospace industry.

The technical findings from Moscow match Check Point's down to the hashes. The framing carries a Russian vendor's politics, describing a China-nexus supply chain without naming China. A single shared address with a cluster attacking Russian targets is thin evidence, though it raises a question no vendor has asked in public. If the Sparrow supply chain also equips teams targeting Russia, the same quartermaster serves operations against Beijing's closest strategic partner.

Microsoft created the Salt Typhoon cluster, and the Wall Street Journal relayed its claim in September 2024 covering FamousSparrow and GhostEmperor. ESET says Microsoft published no technical indicators for that attribution. CrowdStrike's public profile of OPERATOR PANDA lists Salt Typhoon, GhostEmperor, RedMike, and UNC5807, and FamousSparrow is absent. Trend lists all of them as Earth Estries. Whether this threat actor breached US carriers depends on whose naming a reader follows.

The strongest case for Beijing deserves a hearing. The public record holds no tasking documents, procurement records, payments, named officers, or state acknowledgment connecting CopperDragon to the Chinese government. Malware circulates, deployment routines can be copied, nearby servers can be compromised relays, and government and telecom targets attract states, contractors, and criminals alike. That argument cannot explain away the full body of evidence, and "China-nexus" remains well supported. It does show why calling CopperDragon a Chinese state supplier remains provisional.

I examined how one operation drew two names from two firms in a single week with DarkBlinders. The Sparrow ecosystem shows the same problem at scale, with at least six names for overlapping slices of one capability. In my analysis of attribution as a confidence game, Olympic Destroyer's forged fingerprints steered investigators toward the wrong state. Nothing here suggests deliberate deception, though the confusion serves Beijing whether or not anyone planned it.

Hunting Sparrow Tooling

A real browser never asks a visitor to install software to fix a certificate error, and users who know it will refuse SilentDelivery's lure. Security teams can block MSI execution from browser download folders, alert on installers fetched from S3 buckets moments after a site visit, and look for a Run key value named WindowsUpdateAssist. Organizations operating websites in the targeted sectors should check pages for jsjiami-obfuscated scripts calling /image-check, /report-url, or /register-ip.

On Linux, verify ssh and sshd binaries against package manager records, hunt for kernel modules loaded without a file on disk, and look for unexpected Go binaries such as containerd-demo alongside FRP or Chisel. The Reptile-derived rootkit hides from standard tools, so memory analysis and off-host network telemetry matter more than local process listings on a suspected host.

On Windows, look for hidden accounts ending in a dollar sign inside the local Administrators group, LocalAccountTokenFilterPolicy set to 1 on servers, and firewall rules named "RasiUwpApp" or "ss1." New entries in the LSA security packages registry value warrant immediate review. So do WinDivert driver loads on servers and the listed sideloading hosts running from C:\Windows\debug, C:\ProgramData\USOShared, or C:\ProgramData\Waves.

At the network edge, flag servers presenting certificates with 8.8.8.8 as the common name, long-expired certificates on port 443, and TLS sessions on port 443 carrying no HTTP. Unusual volumes of DNS MX queries from workstations deserve the same scrutiny. For Latin American carriers and ministries, Exchange servers reachable from the internet are the documented entry point. Treat these as starting hypotheses for a hunt, and tune each against normal activity in your own environment before it becomes an alert.

The Sparrow framework spans Linux and Windows, from kernel rootkits to a passive backdoor hidden behind a legitimate web server. Its infrastructure repeats the same certificate habits across years. The tools surface in foreign ministries, carriers, and research platforms on three continents through distinct access methods. That evidence supports common development more strongly than it supports common operational control.

Panamanian institutions deciding the future of canal ports, Venezuelan ministries navigating American pressure, Indonesian organizations sent a lure whose name reads as US strategy, and carriers moving Latin America's calls hold different parts of the same strategic answer. Together they show how governments are responding to Washington. Whoever owns the Sparrow framework, the label shapes the political response, from sanctions on a company to the public naming the EU gave an FSB unit in July. The tools, servers, and certificates can be seized and hunted now, before the analysts agree on a name.