{
  "family": "sogou",
  "sample_count": 11,
  "category": "advanced_threat",
  "description": "Adware:Win32/Sogou is a Potentially Unwanted Program (PUA) and adware family frequently associated with aggressive Chinese software bundlers, specifically targeting the installation of input method editors (IMEs) and specialized web browsers. While the core software (like the Sogou Pinyin IME) may offer legitimate functionality, the aggressive bundling tactics, unauthorized browser hijacking, and massive data collection trigger widespread security alerts.<br><br><b>Understanding Sogou Adware</b><br>To an end-user, the infection often begins after downloading freeware from a third-party site. Their default search engine is suddenly changed (often to `sogou.com`), new toolbars appear, and they are bombarded with pop-up advertisements, often in Chinese. For security analysts, Sogou represents a high-risk PUA. The primary concern is not just the adware, but the extensive telemetry and typing data collected by the deeply embedded Input Method Editor (IME) component, which can act as a de-facto keylogger.<br><br><b>Execution and Hijacking Mechanics</b><br>Sogou is typically installed via deceptive freeware bundlers (`T1189`). During installation, it often utilizes 'Dark Patterns' to bypass user consent. It installs browser extensions (`T1176`) to forcefully modify the default homepage and search provider (`T1112`). It establishes robust persistence via Registry Run keys and Scheduled Tasks. Crucially, if the Sogou IME is installed, it hooks deeply into the Windows input subsystem (`T1056.001`), recording keystrokes ostensibly to 'improve predictive typing,' but effectively creating a massive privacy risk as this data is exfiltrated to remote servers in China.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is a degraded user experience, browser hijacking, and severe privacy risks due to keystroke telemetry. Incident responders will observe anomalous DNS requests to `sogou.com` and related affiliate networks. EDR logs will flag the installation of unwanted browser extensions and the persistent hooking of the Windows keyboard APIs.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Sogou and what threat category does it belong to?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Sogou is classified as a Advanced Threat. Documented across security telemetry, it is engineered to execute unauthorized operations, establish persistent footholds on target endpoints, and facilitate malicious campaigns targeting enterprise and individual environments."
      }
    },
    {
      "@type": "Question",
      "name": "How does Sogou establish persistence and evade defensive controls?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Sogou typically establishes persistence through registry run keys, scheduled tasks, or service installations, while evading signature-based antivirus solutions through code obfuscation, memory injection, or anti-analysis sandbox checks."
      }
    },
    {
      "@type": "Question",
      "name": "What are the essential incident response steps for mitigating a Sogou compromise?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Security teams responding to Sogou should immediately isolate affected endpoints from the network, perform memory triage to capture volatile forensic artifacts, audit registry and startup persistence mechanisms, revoke exposed user credentials, and restore systems from verified, clean backups."
      }
    },
    {
      "@type": "Question",
      "name": "What lateral movement and credential access tactics does Sogou leverage in enterprise intrusions?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Sogou frequently utilizes privileged account harvesting techniques such as LSASS memory dumping, Kerberoasting, and token impersonation to escalate privileges. Once administrative credentials are acquired, it pivots across the victim network utilizing living-off-the-land binaries (LOLBins) such as WMI, PowerShell remoting, and PsExec, or abuses remote desktop protocols (RDP) to reach critical internal repositories and domain controllers."
      }
    },
    {
      "@type": "Question",
      "name": "How does Sogou maintain covert communications and evade perimeter network monitoring?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Sogou often relies on multi-stage command and control (C2) architectures utilizing encrypted protocols over standard web ports (HTTPS/443 or DNS tunneling) to blend in with legitimate enterprise network traffic. Many variants incorporate proxy networks, domain fronting, or cloud services (such as Microsoft Graph API, Google Drive, or Telegram) to masquerade C2 channels, bypassing traditional signature-based egress filtering."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1056.001",
    "T1189",
    "T1176",
    "T1562.001",
    "T1112"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1189",
      "name": "Drive-by Compromise (Bundled Installers)",
      "tactic": "Initial Access"
    },
    {
      "id": "T1176",
      "name": "Browser Extensions",
      "tactic": "Persistence"
    },
    {
      "id": "T1112",
      "name": "Modify Registry (Search Hijacking)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1056.001",
      "name": "Input Capture: Keylogging (IME Telemetry)",
      "tactic": "Credential Access"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Quarantine the endpoint to halt the active exfiltration of browsing telemetry and potential keystroke data.",
    "Use the Windows Control Panel to thoroughly uninstall all Sogou-branded software, paying special attention to the Input Method Editor (IME).",
    "Deploy an enterprise adware removal tool (e.g., AdwCleaner) to locate and strip the deeply embedded registry hooks, BHOs, and watchdog services.",
    "Force a complete reset of all installed web browsers to factory defaults to eradicate the rogue extensions and restore the homepage."
  ],
  "what_to_avoid": [
    "Do not rely solely on the browser's 'remove extension' button; the underlying services will likely reinstall the hijacker.",
    "Avoid ignoring the infection; the IME component collects massive amounts of typing data, posing a significant corporate espionage risk."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}