Sogou Zhuyin hit by network compromise
Incident
Summary
Hide ▲
Show ▼
The Sogou Zhuyin update server takeover turned a trusted software channel into a malicious update path, enabling malware delivery to unsuspecting users. The compromise began in October 2024 after attackers seized the lapsed sogouzhuyin[.]com domain tied to the IME service. The abuse helped distribute C6DOOR, GTELAM, DESFY, and TOSHIS, with several hundred victims impacted.
Related Happenings
Augmented Marauder / Water Saci multi-pronged phishing campaign targeting Latin America and Europe
Campaign
H score38
First: 01.04.2026 15:36
Last: 01.04.2026 15:36
Sources 1
About this happening:
On 2026-04-01, Augmented Marauder / Water Saci were reported running a multi-pronged phishing campaign against Spanish-speaking users in organizations across Latin Ameri...
Augmented Marauder / Water Saci multi-pronged phishing campaign targeting Latin America and Europe
CampaignAbout this happening: On 2026-04-01, Augmented Marauder / Water Saci were reported running a multi-pronged phishing campaign against Spanish-speaking users in organizations across Latin Ameri...
VENON Rust-based banking malware targeting Brazilian Windows users
Malware Activity
H score20
First: 12.03.2026 19:31
Last: 12.03.2026 19:31
Sources 1
About this happening:
Researchers disclosed VENON, a new Rust-based banking malware aimed at Brazilian Windows users, raising the risk of credential theft through fake banking overlays....
VENON Rust-based banking malware targeting Brazilian Windows users
Malware ActivityAbout this happening: Researchers disclosed VENON, a new Rust-based banking malware aimed at Brazilian Windows users, raising the risk of credential theft through fake banking overlays....
BadIIS malware deployment on compromised IIS servers in Thailand and Vietnam
Malware Activity
H score27
First: 30.01.2026 14:08
Last: 30.01.2026 14:08
Sources 1
About this happening:
BadIIS is a malicious native IIS module used on compromised IIS servers to support SEO fraud and traffic manipulation. Cisco Talos says the activity is tied to...
BadIIS malware deployment on compromised IIS servers in Thailand and Vietnam
Malware ActivityAbout this happening: BadIIS is a malicious native IIS module used on compromised IIS servers to support SEO fraud and traffic manipulation. Cisco Talos says the activity is tied to...
LongNosedGoblin cyber-espionage campaign targeting government entities in Southeast Asia and Japan
Campaign
H score33
First: 18.12.2025 19:34
Last: 18.12.2025 19:34
Sources 1
About this happening:
A LongNosedGoblin campaign is targeting governmental entities in Southeast Asia and Japan, creating a sustained risk of cyber espionage and file exfiltration insid...
LongNosedGoblin cyber-espionage campaign targeting government entities in Southeast Asia and Japan
CampaignAbout this happening: A LongNosedGoblin campaign is targeting governmental entities in Southeast Asia and Japan, creating a sustained risk of cyber espionage and file exfiltration insid...
APT24 BadAudio multi-delivery espionage campaign
Campaign
H score54
First: 21.11.2025 00:12
Last: 21.11.2025 00:12
Sources 1
About this happening:
APT24 is running a three-year espionage campaign with BadAudio that has expanded into multiple delivery methods, increasing the operation's reach and stealth. Since ...
APT24 BadAudio multi-delivery espionage campaign
CampaignAbout this happening: APT24 is running a three-year espionage campaign with BadAudio that has expanded into multiple delivery methods, increasing the operation's reach and stealth. Since ...
Timeline
-
29.08.2025 16:12 2 articles · 10mo ago
Initial report: Sogou Zhuyin hit by network compromise
Initial DisclosureIn October 2024, attackers took control of the lapsed sogouzhuyin[.]com domain linked to Sogou Zhuyin and began serving malicious updates. The first phase replaced a trusted update channel with a malware-delivery path.
Show sources
- Abandoned Sogou Zhuyin Update Server Hijacked, Weaponized in Taiwan Espionage Campaign — thehackernews.com — 29.08.2025 16:12
- Abandoned Sogou Zhuyin Update Server Hijacked, Weaponized in Taiwan Espionage Campaign — thehackernews.com — 29.08.2025 16:12