{
  "family": "sogou",
  "sample_count": 11,
  "category": "advanced_threat",
  "description": "Adware:Win32/Sogou is a Potentially Unwanted Program (PUA) and adware family frequently associated with aggressive Chinese software bundlers, specifically targeting the installation of input method editors (IMEs) and specialized web browsers. While the core software (like the Sogou Pinyin IME) may offer legitimate functionality, the aggressive bundling tactics, unauthorized browser hijacking, and massive data collection trigger widespread security alerts.<br><br><b>Understanding Sogou Adware</b><br>To an end-user, the infection often begins after downloading freeware from a third-party site. Their default search engine is suddenly changed (often to `sogou.com`), new toolbars appear, and they are bombarded with pop-up advertisements, often in Chinese. For security analysts, Sogou represents a high-risk PUA. The primary concern is not just the adware, but the extensive telemetry and typing data collected by the deeply embedded Input Method Editor (IME) component, which can act as a de-facto keylogger.<br><br><b>Execution and Hijacking Mechanics</b><br>Sogou is typically installed via deceptive freeware bundlers (`T1189`). During installation, it often utilizes 'Dark Patterns' to bypass user consent. It installs browser extensions (`T1176`) to forcefully modify the default homepage and search provider (`T1112`). It establishes robust persistence via Registry Run keys and Scheduled Tasks. Crucially, if the Sogou IME is installed, it hooks deeply into the Windows input subsystem (`T1056.001`), recording keystrokes ostensibly to 'improve predictive typing,' but effectively creating a massive privacy risk as this data is exfiltrated to remote servers in China.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is a degraded user experience, browser hijacking, and severe privacy risks due to keystroke telemetry. Incident responders will observe anomalous DNS requests to `sogou.com` and related affiliate networks. EDR logs will flag the installation of unwanted browser extensions and the persistent hooking of the Windows keyboard APIs.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1056.001",
    "T1189",
    "T1176",
    "T1562.001",
    "T1112"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1189",
      "name": "Drive-by Compromise (Bundled Installers)",
      "tactic": "Initial Access"
    },
    {
      "id": "T1176",
      "name": "Browser Extensions",
      "tactic": "Persistence"
    },
    {
      "id": "T1112",
      "name": "Modify Registry (Search Hijacking)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1056.001",
      "name": "Input Capture: Keylogging (IME Telemetry)",
      "tactic": "Credential Access"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Quarantine the endpoint to halt the active exfiltration of browsing telemetry and potential keystroke data.",
    "Use the Windows Control Panel to thoroughly uninstall all Sogou-branded software, paying special attention to the Input Method Editor (IME).",
    "Deploy an enterprise adware removal tool (e.g., AdwCleaner) to locate and strip the deeply embedded registry hooks, BHOs, and watchdog services.",
    "Force a complete reset of all installed web browsers to factory defaults to eradicate the rogue extensions and restore the homepage."
  ],
  "what_to_avoid": [
    "Do not rely solely on the browser's 'remove extension' button; the underlying services will likely reinstall the hijacker.",
    "Avoid ignoring the infection; the IME component collects massive amounts of typing data, posing a significant corporate espionage risk."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}