Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem

thehackernews.com Nov 11, 2026

Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem

Curated by Shubham · TechCapsules · Nov 11, 2026

AI-summarised brief · reviewed before publication

Check Point Research identified three espionage clusters—SilentDelivery, OceanGate, and DarkWire—linked through the Sparrow malware ecosystem, operated by the China‑nexus group CopperDragon. The campaigns targeted telecoms, government, military, research, and critical infrastructure across Latin America, Asia, and Europe. Attacks used varied initial techniques, including watering holes, JavaScript injection, and phishing with disguised LNK files. The malware suite delivers backdoors such as SparrowDoor, SquadC, and kernel‑level tools, enabling persistence, lateral movement, and data exfiltration.

💡 Why It Matters

· The unified Sparrow framework demonstrates a coordinated, multi‑vector threat capable of infiltrating diverse sectors worldwide, underscoring the escalating sophistication of state‑backed cyber espionage.

Capsules Cybersecurity

Read full article on thehackernews.com

Cisco BroadWorks and Openwave Flaws Actively Exploited Despite Available Patches

The U.S. Cybersecurity and Infrastructure Security Agency added two actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog: CVE‑2026‑111793 in Cisco BroadWorks and CVE‑2026‑20320 in Openwave Messaging Webtop Media Transcoder. Evidence shows attackers used the BroadWorks flaw to upload malicious files and harvest sensitive data, while an AI‑driven campaign, Operation Snowball, exploited the Openwave flaw to enumerate assets, steal credentials, and exfiltrate subscriber records from a European telecom provider. Both exploits involved advanced reconnaissance, autonomous tool development, and persistent web shells. The vulnerabilities were patched, yet exploitation continued, prompting urgent patching for federal agencies by November 24, 2026.

💡 The incidents reveal that AI‑assisted attackers can autonomously orchestrate multi‑stage breaches, turning known software flaws into large‑scale data theft. This underscores the need for rapid patch deployment and enhanced AI‑aware threat detection in critical infrastructure.

thehackernews.com · Nov 11

Hackers Exploit Critical Xen Orchestra Auth Bypass Flaw to Gain Admin Access

French firm Vates VMS has identified a critical authentication bypass flaw in Xen Orchestra, tracked as VSA-2026-062, that allows attackers to send a crafted cookie and gain admin privileges. The vulnerability exploits REST cookie parsing, enabling arbitrary code execution and full root takeover of XCP‑ng nodes. Vates reports active exploitation from a specific IP and TOR domain, though the start date is unclear. The flaw is fixed in Xen Orchestra 6.9.1, 6.10.0, and xo‑server 5.211.2, 5.213.1. Immediate patching or mitigations are advised.

💡 The flaw exposes critical infrastructure to total compromise, underscoring the urgency for timely updates in virtualized environments.

thehackernews.com · Nov 11

Git Patches Flaw That Lets Malicious Repositories Execute Code During Recursive Clones

Git has patched a critical vulnerability (CVE‑2026‑111760) that allowed malicious repositories to execute code on systems performing recursive clones with submodules. The flaw stemmed from an integer truncation in Git’s index handling; an excessively long path could bypass safety checks, be shortened to “.git”, and replace a submodule’s .git file with a symlink to attacker‑controlled hooks. When Git later accessed the submodule, the malicious hooks ran automatically. The issue was addressed in Git 2.56.1 and back‑ported to 2.50.2 through 2.55.1, which now reject overly long paths before truncation. GitHub applied the fixes across its services, including GitHub.com, Enterprise Cloud, and upcoming updates for Desktop, Copilot, Codespaces, and Actions. Users are urged to upgrade to patched versions or follow mitigation steps.

💡 A repository can become a silent drop‑point for code execution, turning routine cloning into a supply‑chain attack. Rapid adoption of the fix is vital to protect the billions of developers who rely on Git’s default cloning behavior.

thehackernews.com · Nov 10

SAP Patches Four CVSS 10.0 Flaws, Including Two Enabling Remote Code Execution

SAP released its November Security Patch Day updates, fixing four critical CVSS 10.0 vulnerabilities that allow remote code execution without authentication. Three flaws reside in the SAP NetWeaver application server—two in the Internet Communication Manager (ICM) and Web Dispatcher, and one in the SAML 2.0 service provider—while the fourth affects SAP Gateway. The ICM and Web Dispatcher bugs, identified as ICM2SHELL, enable memory corruption and OS command execution; the Gateway flaw, PROXYGATE, permits an attacker to impersonate a trusted server and run commands as the system administrator. SAP recommends immediate application of the individual patch notes, particularly for kernels 7.40 through 7.89, and advises upgrading unsupported kernels. The patches address vulnerabilities that could lead to full system compromise and potentially affect connected SAP environments.

💡 The fixes eliminate high‑risk entry points that could let attackers gain unrestricted control over SAP systems, a critical concern for enterprises relying on SAP for core operations. Prompt patching is essential to prevent exploitation that could disrupt business continuity and expose sensitive data.

techcrunch.com · Nov 10

France blames Iran for mass-hacks targeting freezers in grocery stores and blood…

The French government officially blamed Iran for a series of cyberattacks that targeted thousands of internet‑connected industrial freezer and refrigerator units in France and across Europe. The attacks, attributed to the Islamic Revolutionary Guard Corps, raised temperatures in grocery stores and retail supermarkets, spoiling food, and also compromised medical blood banks, though no blood was lost. French Foreign Minister Jean‑Noël Barrot described the incident as unprecedented sabotage, summoned Iran’s ambassador, and announced potential European sanctions and legal action.

💡 The incident exposes the vulnerability of critical food‑storage infrastructure to state‑backed cyber threats, underscoring the need for robust security protocols in essential services.

thehackernews.com · Nov 10

Beyond the Alert: The Case for Rich Network Data

Security teams are increasingly recognizing that prevention alone cannot stop breaches, prompting a shift toward interdiction strategies that rely on rich network data to trace and disrupt attacker activity after an alert fires. While detections are easy to compare during product evaluations, they often leave analysts without the contextual information needed to follow an intrusion’s lateral movement or post‑compromise actions. Shallow data—limited to timestamps, IPs, and basic connections—can dead‑end investigations, whereas richer data captures detailed transaction logs, correlates events, and enables reconstruction of attacker behavior across hosts. The rise of AI‑driven SOC tools amplifies the importance of data depth, as more granular inputs allow algorithms to surface subtle indicators and assist analysts with scripting and query generation. However, AI outputs must still be validated, making data quality and inspectability critical for effective incident response.

💡 Richer network telemetry turns alerts from dead‑ends into actionable intelligence, directly empowering analysts and AI tools to halt attacks before they cause damage.