Abandoned Sogou Zhuyin Update Server Hijacked, Weaponized in Taiwan Espionage Campaign

The Abandoned Sogou Zhuyin update server was hijacked and weaponised as part of an espionage campaign codenamed TAOTH, with C6DOOR, GTELAM, DESFY and TOSHIS among the malware families deployed. Trend Micro researchers Nick Dai and Pierre Lee said the attackers used hijacked software updates and fake cloud storage or login pages to disseminate malware and harvest data, in an operation identified in June 2025.

The attackers took control of the lapsed domain sogouzhuyin[.]com in October 2024 and used it to host malicious updates from October 2024, potentially affecting several hundred victims. TOSHIS is described as a loader that fetches next-stage payloads such as Cobalt Strike or a Merlin agent, while DESFY and GTELAM are spyware variants and C6DOOR is a bespoke Go-based backdoor; all are capable of remote access, information theft, and backdoor activity, with Google Drive cited as a data exfiltration point.

The campaign targeted dissidents, journalists, researchers and technology/business leaders across China, Taiwan, Hong Kong, Japan, South Korea and overseas Taiwanese communities, with Taiwan accounting for 49% of victims. The attackers also conducted reconnaissance and even used phishing to deliver malware, including fake login pages and fake cloud storage pages, to spear-phish Eastern Asia and, to a lesser extent, Norway and the U.S., according to Trend Micro.

According to Trend Micro, the TAOTH shares infrastructure and tooling with earlier ITOCHU-linked activity, suggesting a persistent threat actor focused on reconnaissance and espionage.