SlippyNunchucks deploys DarkVigil through Sogou Input Method
ESET says DNS answers for plain-HTTP config checks were hijacked from July 1, 2026; Tencent fixed it in 16.10.
74
Country
Sri Lanka
- Mentions · 7d2
- Mentions · 30d6
- All mentions8
- First seenAug 23, 2026
- Last mentioned6d ago
Timeline
8 articles · newest firstChina-Aligned Hackers Hijack Sogou Keyboard App to Install DarkVigil Malware
ESET tracks China-aligned group SlippyNunchucks abusing Sogou Input Method updates via DNS hijacking to deploy DarkVigil since mid-2026.
75
China-aligned group abuses Sogou Input Method to deliver malware
ESET researcher names SlippyNunchucks group and details DNS hijacking in Sogou app leading to DarkVigil malware delivery.
60
China-Aligned Hackers Hijack Sogou Input Method to Deploy DarkVigil Backdoor
Attackers abuse DNS hijacking in Sogou Input Method to deliver DarkVigil backdoor to Chinese-speaking users across Asia.
75
SlippyNunchucks hijacks Sogou Input Method to deploy DarkVigil malware
The SlippyNunchucks threat actor hijacked the Sogou Input Method branded vocabulary promotion mechanism to deploy DarkVigil implants targeting Chinese-speaking users in Asia and Europe.
75
ESET maps APT activity from April through September 2026
China-, Iran-, North Korea- and Russia-aligned groups hit governments, semiconductors, drones, crypto firms and Ukraine.
72
Troy Hunt
Troy Hunt warns ShinyHunters' Carhartt breach claim of 50GB and millions of records is unverified, while Sri Lanka joins Have I Been Pwned.
30
Welcoming the Sri Lankan Government to Have I Been Pwned
Have I Been Pwned onboarded Sri Lanka as the 48th government in its free service, letting Sri Lanka CERT monitor domains for breached accounts.
15
Related CVEs
by mentions- HTTP config retrieval in Sogou Input Method for Windows
Appears with
- SlippyNunchucksthreat actor · 6
- DarkVigilmalware · 6
- Sogou Input Methodproduct · 5
- Tencentvendor · 5
- ESETorganization · 2
- Internet café in Dubaivictim · 2
- university student in Denmarkvictim · 2
- multinational gambling organizationvictim · 2
- Sri Lanka CERTorganization · 2
- ESETvendor · 2
- Have I Been Pwnedproduct · 2
- FDMTPmalware · 1
- FamousSparrowthreat actor · 1
- Origin Energyvictim · 1
- Japanvictim · 1
- Arid Viperthreat actor · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.