---
title: One Toolmaker May Be Arming Three China-Nexus Espionage Campaigns
description: Hacked websites showed chosen visitors a bogus Chrome certificate error, served a backdoor disguised as a fix, then hid the lure once it worked.
canonical_url: https://codekeeper.co/ticker/one-toolmaker-may-be-arming-three-china-nexus-espionage-campaigns
---

[Cyberattacks](https://codekeeper.co/ticker/tag/cyberattacks) | [Vulnerabilities](https://codekeeper.co/ticker/tag/vulnerabilities)

# One Toolmaker May Be Arming Three China-Nexus Espionage Campaigns

Hacked websites showed chosen visitors a bogus Chrome certificate error, served a backdoor disguised as a fix, then hid the lure once it worked.

![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png)

By Content Team Nov 13, 2026

Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fone-toolmaker-may-be-arming-three-china-nexus-espionage-campaigns%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fone-toolmaker-may-be-arming-three-china-nexus-espionage-campaigns%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fone-toolmaker-may-be-arming-three-china-nexus-espionage-campaigns%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fone-toolmaker-may-be-arming-three-china-nexus-espionage-campaigns%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fone-toolmaker-may-be-arming-three-china-nexus-espionage-campaigns%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fone-toolmaker-may-be-arming-three-china-nexus-espionage-campaigns%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

ON THIS PAGE

### Want more insights like this?

Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox.

By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) .

On November 10, 2026, Check Point Research tied three espionage campaigns against several dozen high-profile organizations in Latin America, Asia, and Europe to one malware toolkit, the Sparrow framework. It calls the possible developer and supplier CopperDragon, which may equip several China-nexus groups, including FamousSparrow, Earth Estries, TropicTrooper, and UAT-9244. The craftiest, SilentDelivery, has run since early 2026. It plants script on government, shipping, and IT and research sites its targets visit, swaps the page for a fake Chrome certificate error, and pushes a “Certificate Fix” installer that drops the new SquadC backdoor or a SparrowDoor variant. Once a victim is infected, the fake warning stops appearing. OceanGate got into Asian government and critical infrastructure networks through exposed Linux servers. DarkWire targeted at least three major Latin American telecoms, though its tie to CopperDragon rests on infrastructure, not code. There’s no patch to apply: Check Point published indicators, and Windows admins can check for a Run key value named WindowsUpdateAssist. Source: [Infosecurity Magazine](https://www.infosecurity-magazine.com/news/chinese-malware-tied-three-hacking/)

Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fone-toolmaker-may-be-arming-three-china-nexus-espionage-campaigns%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fone-toolmaker-may-be-arming-three-china-nexus-espionage-campaigns%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fone-toolmaker-may-be-arming-three-china-nexus-espionage-campaigns%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fone-toolmaker-may-be-arming-three-china-nexus-espionage-campaigns%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fone-toolmaker-may-be-arming-three-china-nexus-espionage-campaigns%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fone-toolmaker-may-be-arming-three-china-nexus-espionage-campaigns%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp)

Have questions about protecting your software?

Our escrow experts are standing by to help.

[Book a free demo](https://codekeeper.co/book-a-demo)

YOU MAY ALSO LIKE

[Cyberattacks Hijacked GitHub Accounts Plant a CI Secret Stealer, Then Wipe Logs Nov 13, 2026](https://codekeeper.co/ticker/hijacked-github-accounts-plant-a-ci-secret-stealer-then-wipe-logs)

[Cyberattacks Hacker Defaces Victoria’s Exam Board Site Mid-Exams, Claims Leaks Nov 13, 2026](https://codekeeper.co/ticker/hacker-defaces-victorias-exam-board-site-mid-exams-claims-leaks)

[Cyberattacks Settra-Linked GhostFrame Kit Pulls Windows Passwords From ESXi Nov 11, 2026](https://codekeeper.co/ticker/settra-linked-ghostframe-kit-pulls-windows-passwords-from-esxi)

[Cyberattacks Forgotten Qubole Integrations Gave a Hacker Keys to Company Clouds Nov 11, 2026](https://codekeeper.co/ticker/forgotten-qubole-integrations-gave-a-hacker-keys-to-company-clouds)