Three threat activity clusters that researchers have been tracking as separate campaigns share command-and-control infrastructure and malware code similarities strong enough to suggest a common toolchain, according to analysis published by Check Point Research and reported by The Hacker News on 10 November.
The research describes activity observed over the past year against telecommunications providers, government bodies, military institutions, research organisations, and critical infrastructure operators across Latin America, Asia, and Europe. Check Point attributes the activity to China-linked operators — a vendor assessment rather than an independently verified finding, and one that should be weighed as such when consuming threat-intelligence reporting.
Check Point is tracking the clusters under names including SilentDelivery, and presents them as part of what it describes as the broader Sparrow malware ecosystem. The company's full report carries the complete set of cluster names, victimology details, and the indicators of compromise (IOCs) referenced here.
The correlation method behind the finding is the analytical centre of the report: shared code and shared infrastructure observed across campaigns that would otherwise be filed separately. Cluster names are convenient bookkeeping, but they do not mark the boundaries of a search. A defender who has looked only for SilentDelivery indicators is examining one slice of a toolchain that appears under two other labels in the same report, and IOCs pulled from one campaign are at minimum leads on the other two.
Shared tooling can also cut in two directions: it may indicate shared operators, or simply shared code — a kit, a builder, or rented infrastructure passing between groups. Observed artefacts such as a DLL, a domain, or a certificate are data; the conclusion that a single actor stands behind them is an inference, a distinction that carries more weight when attribution carries geopolitical consequences.
For defenders in the sectors named in the report — telecommunications, government, and critical infrastructure in particular — the practical guidance does not depend on who is ultimately behind the campaigns. Where a report names multiple clusters sharing a toolchain, environment searches should cover indicators associated with all of them rather than only the campaign already under tracking. Detection engineering can likewise lean on code and infrastructure correlation instead of static hash lists, which rotate quickly, while shared command-and-control patterns, certificate reuse, and code similarity persist long enough to catch variant drift. When reading attribution claims, the wording itself remains worth noting: an attribution by Check Point is a judgement call, not a log entry.
Read the original findings at The Hacker News.
據 Check Point Research 於 11 月 10 日發表、並由 The Hacker News 報導的分析指出，研究人員一直以來視為獨立攻擊行動跟蹤的三個威脅活動群組，實際上共用命令與控制基礎設施，而惡意代碼的相似程度亦足以顯示它們採用同一套工具鏈。
該研究描述了過去一年觀察到的活動，目標遍及拉丁美洲、亞洲及歐洲的電訊營運商、政府部門、軍方機構、研究組織及關鍵基礎設施營運商。Check Point 將有關活動歸因於中國關聯營運商——這是供應商的評估判斷，而非獨立核實的發現，閱讀威脅情報報導時應按此性質加以衡量。
Check Point 以 SilentDelivery 等名稱跟蹤這些群組，並將它們列為其稱為 Sparrow 惡意軟件生態系的一部分。該公司的完整報告載有全部群組名稱、受害情況詳情，以及本文所述的入侵指標（IOC）。
支撐上述發現的關聯方法，是整份報告的分析核心：這些攻擊行動之間共用的代碼與基礎設施，若非如此便會被分別歸檔。群組名稱只是便於記帳分類，並不能界定搜尋範圍。只搜尋 SilentDelivery 指標的防禦人員，所檢視的只是同一套工具鏈的一部分——該工具鏈在報告中另有兩個標籤，而從單一攻擊行動取得的入侵指標，至少可作為追查其餘兩個群組的線索。
共用工具亦可能有兩種解讀方向：既可能表示由同一批營運商操縱，亦可能只是共用代碼——例如一套工具組、一個建置器，或在不同團體之間轉租的基礎設施。觀察到的構件，如 DLL、域名或證書，屬客觀數據；而斷定其背後為單一攻擊者，則屬推論——當歸因結論牽涉地緣政治後果時，這條界線尤為重要。
對於報告點名的行業——特別是電訊、政府及關鍵基礎設施——防禦人員的實際操作指引，並不會因最終誰是幕後主使而改變。當一份報告點出多個共用工具鏈的群組時，環境搜尋應涵蓋與所有群組相關的指標，而非只侷限於正在跟蹤的攻擊行動。偵測工程同樣可以倚賴代碼與基礎設施的關聯分析，而非靜態雜湊值清單——後者更換頻繁，而共用的命令與控制模式、證書重用及代碼相似性則能維持較長時間，足以捕捉變種漂移。閱讀歸因結論時，措辭本身仍值得注意：Check Point 的歸因屬判斷，而非日誌紀錄。
請於 The Hacker News 閱讀原始研究發現。