Skip to content
NewA calmer, faster ZeroHour
MalwarehighExploited in the wild

China-Aligned Hackers Hijack Sogou Input Method to Deploy DarkVigil Backdoor

Original title: China-Aligned Hackers Hijack Sogou Input Method DNS Requests to Deploy DarkVigil Backdoor

The Hacker News ()3 min read3
Read at thehackernews.com
AI summary · x-ai/grok-4.7Summaries by Vani AI

Attackers abuse DNS hijacking in Sogou Input Method to deliver DarkVigil backdoor to Chinese-speaking users across Asia.

China-aligned SlippyNunchucks threat actor hijacks DNS requests in the Sogou Input Method to deploy the DarkVigil backdoor. The operation, observed since July 2026, targets organizations and Chinese-speaking individuals in Hong Kong, Thailand, Japan, Vietnam, Oman, and Sri Lanka. Tencent released version 16.10 on October 29, 2026, to fix the vulnerability.

Unconfirmed: Attribution as nation-state surveillance effort by ESET; distinction from Mustang Panda based on lack of tactical overlaps in telemetry

Key facts
  • Campaign observed starting July 1, 2026
  • Targets Chinese-speaking users in Hong Kong, Thailand, Japan, Vietnam, Oman, Sri Lanka
  • Abuses Sogou Input Method via DNS tampering to staging servers
  • DarkVigil supports plugin execution via DMTP C2
  • Tencent fixed in version 16.10 released October 29, 2026
Security assessment · AI, from the articleExploited in the wild

Impact: Remote backdoor deployment via hijacked Sogou Input Method

What to do
  1. 1.Upgrade Sogou Input Method to version 16.10 or later
  2. 2.Monitor DNS resolutions for sogou input method domains
  3. 3.Avoid insecure HTTP communications in input methods
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat
CVEs
CVE-2026-120422
Tags
sogou-input-methoddarkvigilslippy-nunchucksdns-hijackingbackdoorsurveillance
Vendors
TencentFortinetESET
Products
Sogou Input MethodQuickFox
Threat actors
SlippyNunchucks
Malware
DarkVigil
Victims
organizations and Chinese-speaking individuals in Hong KongThailandJapanVietnamOmanand Sri Lanka
Countries
Hong KongThailandJapanVietnamOmanSri Lanka

Vulnerabilities mentioned

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-120422
HTTP config retrieval in Sogou Input Method for Windows
8.9—

Indicators of compromise

auto-extracted · verify before use · export allAll
TypeIndicatorContext
domaindev.soft-png-cdn.comvers - 47.239.250[.]102 (sogou-cdn[.]com) 47.237.122[.]175 (dev.soft-png-cdn.com) The consequence of this DNS hijacking was that HTTP reques
domainsogou-cdn.comve it to one of the two staging servers - 47.239.250[.]102 (sogou-cdn[.]com) 47.237.122[.]175 (dev.soft-png-cdn.com) The consequence
domainsogou.comthe executable sends an HTTP request to the "config.pinyin.sogou[.]com/api/brandScd/getBrandScd.php" endpoint to fetch a configu
ipv447.237.122.175he two staging servers - 47.239.250[.]102 (sogou-cdn[.]com) 47.237.122[.]175 (dev.soft-png-cdn.com) The consequence of this DNS hijack
ipv447.239.250.102ered with to resolve it to one of the two staging servers - 47.239.250[.]102 (sogou-cdn[.]com) 47.237.122[.]175 (dev.soft-png-cdn.com)

From the original article

3 min read at thehackernews.com

A China-aligned threat actor known as SlippyNunchucks has been attributed to a Domain Name System (DNS) hijacking operation abusing insecure HTTP communications in Windows versions of Sogou Input Method as part of a surveillance campaign designed to deploy an implant called DarkVigil (aka FDMTP). The campaign, observed starting July 1, 2026, is assessed to have targeted organizations and

The Hacker News

thehackernews.com

Read the full article at The Hacker News

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.