SilentDelivery uses fake Chrome warnings to install Sparrow backdoor
Original title: China-Linked Hackers Use Fake Chrome Certificate Warnings to Infect Victims With Sparrow Backdoor
Check Point says compromised sites push a Windows installer; the chain does not show a Chrome vulnerability.
Check Point describes SilentDelivery, a campaign in which China-linked operators replace pages on compromised government, shipping, IT and research sites with a fake Chrome certificate warning. Selected Windows visitors are urged to install a repair utility that instead delivers the SquadC backdoor or a SparrowDoor variant. SquadC supports commands, files, system data and screenshots. Check Point links the activity to the Sparrow framework and CopperDragon as a possible tool supplier, while warning that shared malware does not prove one operator.
Unconfirmed: Check Point says shared backdoors or servers do not establish that FamousSparrow, Earth Estries, TropicTrooper and UAT-9244 are one operator.
- Targets are mainly high-profile organizations in Europe and Asia, with selective IP and location checks.
- Three clusters tied to Sparrow include OceanGate on Linux and DarkWire against Latin American telecom and government targets.
- CopperDNS carries command traffic through DNS MX queries.
- A separate path delivered SquadC via a malicious shortcut inside an archive.
- Check Point published installer and loader hashes plus lookalike domains such as microsfot.vip.
Impact: Remote access backdoor on Windows after a fake certificate install
- 1.Investigate unexpected certificate-repair downloads instead of trusting the Chrome branding.
- 2.Treat related archive shortcuts as phishing delivery for SquadC.
- ATT&CK
- T1189 Drive-by CompromiseT1204.002 Malicious FileT1036 MasqueradingT1566.001 Spearphishing Attachment
- Vendors
- Products
- Chrome
- Organizations
- Check Point
- Countries
- China
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | aistei.com | 0f0f338f561f18 Domains microsfot[.]vip , microscoft[.]vip , aistei[.]com , astorialaza[.]com IP addresses 135.136.135[.]54 , 103.1 |
| domain | astorialaza.com | Domains microsfot[.]vip , microscoft[.]vip , aistei[.]com , astorialaza[.]com IP addresses 135.136.135[.]54 , 103.141.235[.]123 , 109.2 |
| domain | microscoft.vip | bd963cf94870c82a5920f0f338f561f18 Domains microsfot[.]vip , microscoft[.]vip , aistei[.]com , astorialaza[.]com IP addresses 135.136.1 |
| domain | microsfot.vip | 78bc0ab510b0fca6ffbd963cf94870c82a5920f0f338f561f18 Domains microsfot[.]vip , microscoft[.]vip , aistei[.]com , astorialaza[.]com IP |
| ipv4 | 103.141.235.123 | i[.]com , astorialaza[.]com IP addresses 135.136.135[.]54 , 103.141.235[.]123 , 109.205.195[.]131 , 158.255.213[.]189 , 165.154.227[.]1 |
| ipv4 | 109.205.195.131 | a[.]com IP addresses 135.136.135[.]54 , 103.141.235[.]123 , 109.205.195[.]131 , 158.255.213[.]189 , 165.154.227[.]16 , 45.197.12[.]11 , |
| ipv4 | 135.136.135.54 | scoft[.]vip , aistei[.]com , astorialaza[.]com IP addresses 135.136.135[.]54 , 103.141.235[.]123 , 109.205.195[.]131 , 158.255.213[.]1 |
| ipv4 | 158.255.213.189 | 135.136.135[.]54 , 103.141.235[.]123 , 109.205.195[.]131 , 158.255.213[.]189 , 165.154.227[.]16 , 45.197.12[.]11 , 91.210.164[.]5 Note |
| ipv4 | 165.154.227.16 | 103.141.235[.]123 , 109.205.195[.]131 , 158.255.213[.]189 , 165.154.227[.]16 , 45.197.12[.]11 , 91.210.164[.]5 Note: IP addresses and |
| ipv4 | 45.197.12.11 | 109.205.195[.]131 , 158.255.213[.]189 , 165.154.227[.]16 , 45.197.12[.]11 , 91.210.164[.]5 Note: IP addresses and domains are inten |
| ipv4 | 91.210.164.5 | 1 , 158.255.213[.]189 , 165.154.227[.]16 , 45.197.12[.]11 , 91.210.164[.]5 Note: IP addresses and domains are intentionally Qdefange |
| sha256 | 054c0ffb08eb7830de1ff2356af4d2ed696f01111a8c2e78e3a4ddc940287e48 | e31c7da37bf1540a4e7ec3d80870f8d6bd1f5d4cecbb Loader SHA-256 054c0ffb08eb7830de1ff2356af4d2ed696f01111a8c2e78e3a4ddc940287e48 Loader SHA-256 b60404c1299e69df029d9817dcf69f9fe325ecc990e1 |
| sha256 | 715c206629f59ff5b0134a33362162ce7a40a9b25aa17f0543dc9648d51a67cf | ):- Indicator type Source-published value Installer SHA-256 715c206629f59ff5b0134a33362162ce7a40a9b25aa17f0543dc9648d51a67cf Installer SHA-256 b379d07ba81d4190490d9893b2d6d830ff594e042 |
| sha256 | 8bbc395a7a0faff074c6e31c7da37bf1540a4e7ec3d80870f8d6bd1f5d4cecbb | d46faa25033e1151060cd3482ad4439754440d6c4c01 Loader SHA-256 8bbc395a7a0faff074c6e31c7da37bf1540a4e7ec3d80870f8d6bd1f5d4cecbb Loader SHA-256 054c0ffb08eb7830de1ff2356af4d2ed696f01111a8c |
| sha256 | b379d07ba81d4190490d9893b2d6d830ff594e042dce26053ef07794d0403787 | 3362162ce7a40a9b25aa17f0543dc9648d51a67cf Installer SHA-256 b379d07ba81d4190490d9893b2d6d830ff594e042dce26053ef07794d0403787 Installer SHA-256 e5f7bbfc187264336dea5dfebfb5a7dd1e7fcdcc9 |
| sha256 | b60404c1299e69df029d9817dcf69f9fe325ecc990e16bc7758f56ce5714184b | f2356af4d2ed696f01111a8c2e78e3a4ddc940287e48 Loader SHA-256 b60404c1299e69df029d9817dcf69f9fe325ecc990e16bc7758f56ce5714184b Loader SHA-256 f23e5391656b178bc0ab510b0fca6ffbd963cf94870c |
| sha256 | e5f7bbfc187264336dea5dfebfb5a7dd1e7fcdcc9692db55fbe6eb4d28f027bc | 3b2d6d830ff594e042dce26053ef07794d0403787 Installer SHA-256 e5f7bbfc187264336dea5dfebfb5a7dd1e7fcdcc9692db55fbe6eb4d28f027bc Installer SHA-256 e9f2f42ea3611096879f4152a7d78bb3a78a4dbea |
| sha256 | e9f2f42ea3611096879f4152a7d78bb3a78a4dbead1c3b7e366dce485207551f | ebfb5a7dd1e7fcdcc9692db55fbe6eb4d28f027bc Installer SHA-256 e9f2f42ea3611096879f4152a7d78bb3a78a4dbead1c3b7e366dce485207551f Installer SHA-256 f44159bec1d4d3f340652cd3c6e250dcf2bdb266e |
| sha256 | f23e5391656b178bc0ab510b0fca6ffbd963cf94870c82a5920f0f338f561f18 | 9817dcf69f9fe325ecc990e16bc7758f56ce5714184b Loader SHA-256 f23e5391656b178bc0ab510b0fca6ffbd963cf94870c82a5920f0f338f561f18 Domains microsfot[.]vip , microscoft[.]vip , aistei[.]com , |
| sha256 | f44159bec1d4d3f340652cd3c6e250dcf2bdb266e5400d3e267f0466d290dda0 | 2a7d78bb3a78a4dbead1c3b7e366dce485207551f Installer SHA-256 f44159bec1d4d3f340652cd3c6e250dcf2bdb266e5400d3e267f0466d290dda0 Installer SHA-256 f51dc5e1848daee4e607d46faa25033e1151060cd |
| sha256 | f51dc5e1848daee4e607d46faa25033e1151060cd3482ad4439754440d6c4c01 | 3c6e250dcf2bdb266e5400d3e267f0466d290dda0 Installer SHA-256 f51dc5e1848daee4e607d46faa25033e1151060cd3482ad4439754440d6c4c01 Loader SHA-256 8bbc395a7a0faff074c6e31c7da37bf1540a4e7ec3d8 |
From the original article
4 min read at cybersecuritynews.com
China-linked hackers are turning trusted websites into malware delivery points by displaying fake Google Chrome certificate warnings. The pages urge selected visitors to install a certificate repair utility, but the download instead installs a backdoor that gives attackers remote access to Windows computers. The campaign, tracked as SilentDelivery, targets high-profile organizations mainly across Europe and […]
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.