As cited
Copy frozen at (site build).
threat intel
China-Aligned Hackers Hijack Sogou Input Method DNS Requests to Deploy DarkVigil Backdoor
China-aligned threat actor SlippyNunchucks exploited insecure HTTP communications in Windows versions of Sogou Input Method to hijack Domain Name System (DNS) requests and deploy the DarkVigil backdoor. The surveillance campaign began July 1, 2026, and targeted organizations through the compromised input method software.
Why it matters: Organizations using Sogou Input Method on Windows systems face DNS hijacking and backdoor implantation; patching or removing the affected software and monitoring for DarkVigil indicators of compromise (IOCs) is critical.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
China-Aligned Hackers Hijack Sogou Input Method DNS Requests to Deploy DarkVigil Backdoor
China-aligned threat actor SlippyNunchucks exploited insecure HTTP communications in Windows versions of Sogou Input Method to hijack Domain Name System (DNS) requests and deploy the DarkVigil backdoor. The surveillance campaign began July 1, 2026, and targeted organizations through the compromised input method software.
Why it matters: Organizations using Sogou Input Method on Windows systems face DNS hijacking and backdoor implantation; patching or removing the affected software and monitoring for DarkVigil indicators of compromise (IOCs) is critical.
- Source published
- First seen by Cybersecurity Tracker