CANONSTAGER DLL Sideloading and SOGU.SEC Payload Access (UNC6384 Campaign Hijacks Web Traffic to Target Diplomats)

Kaung Khant Ko@kaungkhantko

•updated Aug 26, 2025•2•2•47

Detects potential DLL side-loading of the CANONSTAGER malware, which is used to deploy the SOGU.SEC backdoor. This rule identifies when the legitimate, signed Canon IJ Printer Assistant Tool (cnmpaui.exe) loads an unsigned DLL with a similar name (cnmpaui.dll) and subsequently reads a .dat file (cnmplog.dat), consistent with the TTPs of the PRC-nexus actor UNC6384.