Plan ahead High Monitor
Check Point links three China-linked spying campaigns to Sparrow malware
Check Point Researchtelecommunications, government, military
What happened. Check Point Research found three clusters (SilentDelivery, OceanGate, DarkWire) across Latin America, Asia and Europe. They share infrastructure and Sparrow malware code. Targets include telecoms, government, military, research and critical infrastructure. Methods include compromised internet-facing systems and watering-hole attacks.
Who is affected. Telecommunications providers, government, military, research institutions and critical infrastructure; compromised watering-hole websites were in government, shipping, and IT and research sectors. No specific products are named.
What to do. Review exposure of internet-facing systems and brief your security team on Sparrow activity; monitor for the indicators Check Point Research publishes.
When to act. Plan ahead: Critical infrastructure operators: a China-linked espionage group is reported active; check internet-facing systems…
Editor's reading
ForOT security leaddetection engineerIT security
- Purdue level
- L5
- L4
Why: The report describes espionage through internet-facing infrastructure and compromised websites, which sit at the enterprise and internet edge; it describes no OT-specific tooling.
- Are you exposed?
Check whether internet-facing servers or staff browsing habits match the activity described, and search logs for the indicators in the Check Point report.
- If you cannot fix it yet
- Patch or restrict internet-facing servers and gateways, and keep them off the plant network.
- Limit web browsing from engineering and operations workstations to reduce watering-hole exposure.
- Segment corporate IT from OT so an IT foothold cannot reach plant systems.
- Watch for
- Unexpected outbound connections from internet-facing servers, including passive backdoor behaviour on Windows and Linux hosts.
- Indicators of compromise (hashes, domains, IP addresses) in Check Point's Sparrow report.
Inferred from the facts above, not stated by the source. Check it against your own site before acting.
Source: Check Point Research (opens research.checkpoint.com)
More on Telecommunications Government