China-aligned hackers hijack Sogou Input Method DNS requests to deploy DarkVigil backdoor
THREAT ACTORredteam/daily · 1 source
- Severity
- High
- Sources
- 1
What happened
SlippyNunchucks, assessed as China-aligned, is conducting a DNS hijacking operation that abuses insecure HTTP communications in the Windows build of Sogou Input Method to deliver the DarkVigil (FDMTP) implant. The surveillance campaign was observed from 1 July 2026 and was assessed to target organisations; the article is truncated and gives no CVE, affected build numbers or IOCs. Defenders should review whether Sogou Input Method is deployed on Windows endpoints, check DNS and HTTP traffic from it for redirection, and watch for DarkVigil/FDMTP indicators.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Check whether Sogou Input Method is installed on Windows systems in your environment.
- Review DNS and HTTP traffic from Sogou Input Method for signs of redirection to unexpected hosts.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
The Hacker News