Sogu

SOGU is a malicious software (malware) attributed to TEMP.Hex, a threat actor linked to China. The malware is designed to exploit and damage computer systems, often infiltrating them through suspicious downloads, emails, or websites. Once inside, it can steal personal information, disrupt operations, or even hold data hostage for ransom. SOGU has been associated with various other malware including SHOTPUT, COOKIECUTTER, PANDORA, ZXSHELL, GHOST, WIDEBERTH, QUICKPULSE, FLOWERPOT, TEMPFUN, Gh0st, TRAVELNET, HOMEUNIX, and ZEROTWO. The primary infection vector of the SOGU malware is through an infected USB drive. However, it also uses phishing emails as its initial compromise method. These emails, often generic in nature and appearing to be spam, are used by APT3, another threat actor. APT27 and APT21, on the other hand, use spear phishing as their initial compromise method, leveraging email messages with malicious attachments, links to malicious files, or web pages. SOGU loaders have been identified in several instances (#9214, #9215) being delivered via email as compressed attachments. In terms of technical execution, the SOGU loader is written to disk (#9210), then moves into a pre-execution phase (#9211). It is then transferred over HTTP/S (#9212, #9213). SafeBreach provides coverage of the SOGU malware, offering insights into its operation and potential countermeasures. Understanding this malware and its attack vectors is crucial in developing effective defenses and response strategies.