Threat video1:00
SlippyNunchucks DarkVigil Sogou Hijack: Detection & IOCs
SlippyNunchucks hijacks Sogou DNS to drop DarkVigil through DLL sideloading. 25 IOCs and 9 detection rules, incl. a free Splunk SPL rule.
Read the full threat intel for SlippyNunchucks DarkVigil Sogou Hijack: Detection & IOCs →
Chapters
- 0:00The hookSogou backdoor targeted six nations.
- 0:04The storySlippyNunchucks hijacks Sogou DNS configs.
- 0:11Attack pathAccording to researchers, DNS hijacking serves forged Sogou config.
- 0:27AttributionAttributed to SlippyNunchucks.
- 0:31Indicators of compromise16 indicators to hunt: 4 IPs, 5 domains and 1 URL, and more.
- 0:38MITRE ATT&CK techniques8 ATT&CK techniques, from initial access to command and control.
- 0:43Remediation5 steps now: Update Sogou Input Method for Windows to version 16.10.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Sogou backdoor targeted six nations.
0:05SlippyNunchucks hijacks Sogou DNS configs.
0:08Drops DarkVigil backdoor via sideloading.
0:12According to researchers, DNS hijacking serves forged Sogou config.
0:16Downloads the DarkVigil backdoor library.
0:19Sideloads it into Adobe binaries.
0:22Contacts C2, loads plugins, relays commands.
0:27Attributed to SlippyNunchucks. Confidence: medium.
0:3216 indicators to hunt: 4 IPs, 5 domains and 1 URL, and more.
0:398 ATT&CK techniques, from initial access to command and control.
0:445 steps now: Update Sogou Input Method for Windows to version 16.10.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.