DarkVigil
Linked
Latest
China-aligned group abuses Sogou Input Method to deliver DarkVigil backdoor
SlippyNunchucks, a China-aligned group, has abused Sogou Input Method since 1 July 2026 to deploy the DarkVigil .NET backdoor against users in several countries. The attackers hijacked DNS for a plain HTTP settings request, returned a forged file, and used DLL side-loading with a renamed, signed Adobe helper to load the implant. Tencent fixed the weakness in version 16.10, tracked as CVE-2026-120422.
China-aligned hackers abused Sogou keyboard updates to install DarkVigil malware
A China-aligned espionage group abused the update traffic of Sogou Input Method to deliver the DarkVigil implant to victims' machines. ESET Research, which tracks the group as SlippyNunchucks, published its findings on 4 November 2026, and Tencent has patched the flaw in version 16.10.
China-aligned hackers hijack Sogou Input Method DNS requests to deploy DarkVigil backdoor
SlippyNunchucks, a China-aligned threat actor, is abusing insecure HTTP traffic in the Windows version of Sogou Input Method to hijack DNS requests. The redirected traffic is used to deploy the DarkVigil implant (also known as FDMTP) as part of a surveillance campaign observed from 1 July 2026. The article describes organisations being targeted but is cut off before listing the victims.