TAOTH Campaign: Hijacked Software Updates Are Spreading Malware Across Asia

Trend Micro researchers have detailed a cyber-espionage operation dubbed TAOTH, which uses hijacked software updates and spear-phishing to deliver multiple malware families across Eastern Asia. The campaign, which began in late 2024, has targeted dissidents, journalists, researchers, and business leaders in China, Taiwan, Hong Kong, Japan, and South Korea.

It first came to light when infections involving C6DOOR and GTELAM were investigated; according to Trend Micro, “The software had stopped receiving updates in 2019; in October 2024 attackers took over the lapsed domain name and used it to distribute malicious payloads.” By seizing control of the abandoned Sogou Zhuyin IME update server, attackers distributed four malware families—TOSHIS, DESFY, GTELAM, and C6DOOR—via what appeared to be legitimate update processes.

Victims often downloaded the official installer, but a few hours after installation the automatic update process was triggered and malicious updates were retrieved from the attacker-controlled domain, according to Trend Micro. In addition to the supply-chain style attack, TAOTH also relied on spear-phishing campaigns targeting victims in Eastern Asia, with a small portion identified in the United States and Norway.