Threat Intel

China-Aligned Hackers Hijack Sogou Input Method DNS Requests to Deploy DarkVigil Backdoor

The SlippyNunchucks group exploits Sogou Input Method's unencrypted HTTP updates via DNS hijacking to deploy the DarkVigil backdoor—a reminder that any plaintext update channel is a viable implant vector.

Summary written by editorial AI · Source link below

Filed by THN (Feedburner)4 November 20261 min readRead at source ↗

A China-aligned threat actor known as SlippyNunchucks has been attributed to a Domain Name System (DNS) hijacking operation abusing insecure HTTP communications in Windows versions of Sogou Input Method as part of a surveillance campaign designed to deploy an implant called DarkVigil (aka FDMTP).

The campaign, observed starting July 1, 2026, is assessed to have targeted organizations and

Editorial Analysis

Why it matters

Any enterprise permitting software with plaintext update channels faces the same class of risk; the campaign shows state-level actors actively exploiting this weakness at scale.

What to do

Inventory all software on managed endpoints that uses HTTP (not HTTPS) for updates or telemetry, and block or force-upgrade those applications.

Forward-looking interpretation drafted by editorial AI under human review — not a reproduction of the source. See methodology.

Continue at the source

Read the full report at THN (Feedburner)

External link — opens at THN (Feedburner) in a new tab.

Continue with

Editorial Analysis

More from the Threat Intel Desk