China-linked cybercriminals have been employing deceptive Google Chrome certificate alerts to distribute malware through compromised websites. This sophisticated attack persuades users to download a so-called ‘certificate repair utility,’ which instead installs a backdoor, granting attackers remote access to the victim’s Windows systems.
Targeted Malware Campaign in Europe and Asia
The operation, known as SilentDelivery, specifically targets high-profile entities primarily in Europe and Asia. Hackers have infiltrated websites belonging to government agencies, shipping companies, IT firms, and research institutions. They use familiar browser error messages to convince users that installing software is essential to restore access.
Security experts at Check Point have uncovered the previously unknown SquadC backdoor while analyzing this attack, alongside instances of the SparrowDoor variant being deployed. Their investigation links SilentDelivery to a broader malware environment associated with CopperDragon, a potential developer aiding various China-associated threat groups.
Methodology Behind the SilentDelivery Attack
The infection pathway begins when a user visits a compromised site, where injected JavaScript replaces the legitimate page with a fraudulent Chrome SSL certificate warning in the site’s native language. An ‘Install certificate’ button misleads users into downloading a harmful Windows Installer package. This strategy is reminiscent of past campaigns that masqueraded malware as Chrome updates.
Check Point researchers discovered three compromised S3 buckets used to host subsequent payloads. The attack employs the jsjiami obfuscation service to conceal its malicious intent. Before triggering the warning, the script verifies if the visitor is using Windows and, in some cases, if the domain matches the intended target, thereby ensuring that only suitable victims are targeted.
Implications and Broader Espionage Network
SilentDelivery is part of a complex network linked to the Sparrow framework. Previous reports have documented the evolution of the SparrowDoor backdoor, cautioning against attributing all related intrusions to a single group. CopperDragon appears to function as a digital supplier, providing tools to various operators such as FamousSparrow and TropicTrooper.
The attack’s infrastructure, including reused certificates, suggests shared resources among these groups, although it does not confirm a single controlling entity. This evidence underscores the need for a comprehensive approach to cybersecurity, especially when facing sophisticated and well-coordinated threat actors.
For security professionals, it is crucial to treat unexpected certificate-repair downloads with skepticism and consider the potential for related phishing threats. Check Point’s observations also highlight the use of phishing to distribute the SquadC backdoor through malicious shortcuts embedded in archives. Vigilance and proactive threat hunting remain critical to safeguarding against such advanced cyber threats.
