China-Aligned Hackers Hijack Sogou Input Method DNS Requests to Deploy DarkVigil Backdoor
Overview
A group of hackers known as SlippyNunchucks, believed to be aligned with China, has conducted a DNS hijacking operation targeting the Sogou Input Method on Windows. This attack, which began on July 1, 2026, exploits insecure HTTP communications to deploy a backdoor known as DarkVigil. The campaign seems aimed at organizations, likely for surveillance purposes. Users of the Sogou Input Method should be particularly cautious, as the breach could lead to unauthorized access to sensitive information. This incident raises concerns about the security practices of widely used software and the implications for user data privacy.
Key Takeaways
- Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
- Affected Systems: Sogou Input Method on Windows
- Action Required: Users should consider switching to secure input methods, ensure their systems are updated regularly, and monitor for any unusual activity.
- Timeline: Ongoing since July 1, 2026
Original Article Summary
A China-aligned threat actor known as SlippyNunchucks has been attributed to a Domain Name System (DNS) hijacking operation abusing insecure HTTP communications in Windows versions of Sogou Input Method as part of a surveillance campaign designed to deploy an implant called DarkVigil (aka FDMTP). The campaign, observed starting July 1, 2026, is assessed to have targeted organizations and
Impact
Sogou Input Method on Windows
Exploitation Status
This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.
Timeline
Ongoing since July 1, 2026
Remediation
Users should consider switching to secure input methods, ensure their systems are updated regularly, and monitor for any unusual activity.
Additional Information
This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.
Related Topics: This incident relates to Windows, Microsoft.