Malware campaign hijacks Sogou Input Method traffic on Windows in DNS-based attack
ESET researchers say an attacker dubbed SlippyNunchucks abused insecure HTTP traffic in the Windows version of Sogou Input Method to hijack its brand promotion mechanism and push malware instead of legitimate content.
A routine Chinese text input tool on Windows has become an entry point for malware, according to new research.
ESET has documented a campaign in which a threat actor it calls “SlippyNunchucks” hijacked the brand promotion mechanism in Sogou Input Method, a widely used Chinese-language input program for Windows. The attackers took advantage of insecure HTTP communications and weaknesses in how the software used the Domain Name System (DNS) to redirect some of its traffic and deliver malicious files.
Sogou Input Method regularly contacts remote servers to download brand-related content and promotions that update what users see. ESET’s analysis found that these update checks were not always protected by strong encryption or integrity checks. That left an opening for anyone able to manipulate DNS responses or traffic along the network path.
By hijacking DNS, which translates website names into numerical IP addresses, SlippyNunchucks steered part of Sogou’s traffic to servers under its control. Instead of harmless promotional material, those servers responded with malware installers that appeared to be normal Sogou traffic. Because the connections came from a trusted application and looked routine, they were less likely to attract attention.
For individual users, this means software they rely on simply to type Chinese characters could silently pull in code that steals data, opens backdoors or enrolls the machine in a botnet. In offices where Sogou Input Method is widely installed on Windows machines, a single compromised computer can give attackers a foothold inside a corporate network.
The operation shows how attackers are shifting focus to background services and update channels that do not get much scrutiny. Tools such as language input methods and automatic updaters reach out to the internet on a regular basis and are often trusted by default, making them attractive vectors if their traffic is not properly secured.
The choice of Sogou Input Method suggests a potentially large group of victims, given the program’s popularity among Chinese-speaking users and its presence on many Windows systems. ESET’s report does not attribute SlippyNunchucks to a particular state or criminal group, but the use of DNS hijacking against insecure HTTP traffic does not require sophisticated or rare capabilities.
The case also undercuts any assumption that domestic software is automatically safer. Without strong encryption and validation on every network path, widely deployed tools can be turned into distribution channels for malware.
Key things to watch now include whether Sogou updates its Windows client to harden network security, whether regulators push for stricter standards on similar utilities, and whether defenders begin to look more closely at traffic generated by language tools and other background applications that depend on internet connections.
Sources
- OSINT