Threat video1:00
CopperDragon Sparrow Framework: Detection & IOCs
CopperDragon's Sparrow framework powers China-nexus attacks in Europe, Asia and Latin America. Adds 9 detection rules, 32 IOCs and a free Splunk SPL rule.
Read the full threat intel for CopperDragon Sparrow Framework: Detection & IOCs →
Chapters
- 0:00The hookOne framework, three campaigns.
- 0:04The storyLegitimate websites were compromised.
- 0:10Attack pathA script fingerprints visitors.
- 0:23AttributionAttributed to CopperDragon.
- 0:27Indicators of compromise32 indicators to hunt: 7 IPs, 14 domains and 9 SHA-256 hashes, and more.
- 0:37MITRE ATT&CK techniques25 ATT&CK techniques, from initial access to command and control.
- 0:42Remediation4 steps now: Block and hunt the published domains, IPs and SHA-256 hashes.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00One framework, three campaigns.
0:05Legitimate websites were compromised.
0:07Visitors saw a fake warning.
0:11A script fingerprints visitors.
0:13Then a fake certificate error appears.
0:15A loader runs SquadC in memory.
0:17Persistence uses a Run key.
0:23Attributed to CopperDragon. Confidence: medium.
0:2732 indicators to hunt: 7 IPs, 14 domains and 9 SHA-256 hashes, and more.
0:3725 ATT&CK techniques, from initial access to command and control.
0:424 steps now: Block and hunt the published domains, IPs and SHA-256 hashes.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.