A Chinese hacking group exploited a flaw in Sogou Input Method, a widely used tool for typing Chinese characters on Windows, to install a backdoor on victims' computers, according to research published Thursday by security company Gen Digital This article explores discovered browser protections. . Gen discovered two of the browser's protections were disabled and included in the code: the sandbox, which normally keeps a compromised webpage isolated from the rest of the computer, and the same-origin policy, which prevents a page from reading data from other sites.
In their response, they stated that the chain was relatively complex and that an attacker would need social engineering to get the user to "actively authorize the browser's pop-up prompt." Browsers based on Chromium display a confirmation box before handing a link to an external program on a computer. All three individuals navigated to C:\Users\Public\Documents.
It now looks for the two arguments that contain web addresses, rejecting anything that isn't HTTPS, and verifies the hostname against four permitted endings: sogou.com, qq.com, woa.com, and sogou.
Gen published these indicators: SHA-256 29c7ee41d0cc9e07d981e451df56d0c3d37c41ac4ec10c7b516cc033ee397a63 malicious DLL loader, written as 7z.dll SHA-256 749160a2f20f82744026719cf72e483595c6aad718efa74d675a98662e02422e encrypted payload file, named p SHA-256 d7a3c7eb94edc0e020f74c678743d71d61e944634aade4a67a96c3589e828b3a GRAYRABBIT backdoor, internal name core.dll Domain mail.uaiubifas[. ]top backdoor command server, port 443 Domain noht1ng[. ]top hosted the exploit page IP 8.218.50[.
]207 staging server, Alibaba Cloud Hong Kong Path C:\Users\Public\Documents\ where the three files were written
