Threat actor · 1 source · latest 2h

China-aligned group abuses Sogou Input Method to deliver DarkVigil backdoor

THREAT ACTORDarkVigilredteam/daily · 1 source

Severity: High
Highest CVSS: 8.9
Exploited: Not known
Sources: 1

What happened

SlippyNunchucks, a China-aligned group, has abused Sogou Input Method since 1 July 2026 to deploy the DarkVigil .NET backdoor against users in several countries. The attackers hijacked DNS for a plain HTTP settings request, returned a forged file, and used DLL side-loading with a renamed, signed Adobe helper to load the implant. Tencent fixed the weakness in version 16.10, tracked as CVE-2026-120422.

For IT people · Written by AI from 1 source · Wrong?

What to do

Update Sogou Input Method to version 16.10 or later.
Check router DNS settings for signs of tampering.
Look for connections to the listed DarkVigil domains and IP addresses in your logs.
Search Sogou's Components folder for unexpected Adobe-named files.

Written by AI from the sources, checked against them

Read the full story at the source