Sogou Input Method used in cyberattacks by SlippyNunchucks

Cybersecurity firm ESET has identified a cyberattack campaign targeting Chinese-speaking users and organizations globally by exploiting a vulnerability in the Sogou Input Method, a widely used Chinese keyboard application.

Researchers discovered that the China-linked Advanced Persistent Threat (APT) group, known as SlippyNunchucks, utilized a DNS hijacking operation to exploit insecure HTTP communications in the Windows version of the software. The group used the application to distribute DarkVigil malware and redirect user internet connections.

The campaign targeted entities in Hong Kong, Thailand, Japan, Vietnam, Oman, and Sri Lanka, while also reaching users across Asia and Europe. The attack specifically manipulated a branded word promotion mechanism within the SGTool.exe component to deliver malicious configurations and payloads.

Tencent, the developer of Sogou Input Method, has released an update to address and close the security vulnerability.