China-Aligned Hackers Hijack Sogou Input Method DNS Requests to Deploy DarkVigil Backdoor
Summary
A China-aligned threat actor known as SlippyNunchucks is reportedly conducting a DNS hijacking operation that abuses insecure HTTP communications in the Windows version of Sogou Input Method. The campaign, observed starting July 1, 2026, is a surveillance operation intended to deploy an implant called DarkVigil (also known as FDMTP). The article states that organizations and other targets were affected, though the content is truncated.
IFF Assessment
A state-linked actor is actively exploiting a widely used application's insecure network traffic to deliver a surveillance backdoor, which advantages attackers and complicates defenders' detection.
Defender Context
Defenders should check for Sogou Input Method on Windows endpoints, block or monitor its unencrypted HTTP traffic, and watch for anomalous DNS responses and connections associated with the SlippyNunchucks campaign. Insecure update and telemetry channels in consumer software are a recurring vector for supply-chain and espionage operations, so organizations should treat unencrypted application traffic as a risk to be inventoried and mitigated.