China-aligned hackers hijack Sogou Input Method DNS requests to deploy DarkVigil backdoor
THREAT ACTORredteam/daily · 1 source
- Severity
- High
- Sources
- 1
What happened
SlippyNunchucks, a China-aligned threat actor, is abusing insecure HTTP traffic in the Windows version of Sogou Input Method to hijack DNS requests. The redirected traffic is used to deploy the DarkVigil implant (also known as FDMTP) as part of a surveillance campaign observed from 1 July 2026. The article describes organisations being targeted but is cut off before listing the victims.
For IT people · Written by AI from 1 source · Wrong?
What to do
- Check whether Sogou Input Method is installed on Windows systems in your environment.
- Review DNS and HTTP traffic from Sogou Input Method for signs of redirection to unexpected hosts.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
The Hacker News