China-Aligned Hackers Hijack Sogou Keyboard App to Install DarkVigil Malware
ESET tracks China-aligned group SlippyNunchucks abusing Sogou Input Method updates via DNS hijacking to deploy DarkVigil since mid-2026.
Stories per day · 30 days
2 RSS
Relateddarkvigil4dns-hijacking3espionage2input-method2china-aligned1dll-sideloading1keyboard-app1malware1slippy-nunchucks1slippynunchucks1slippyunchucks1supply-chain1tencent1
6 stories, newest first · one card per story
Stories tagged #sogou
China-aligned group abuses Sogou Input Method to deliver malware
ESET researcher names SlippyNunchucks group and details DNS hijacking in Sogou app leading to DarkVigil malware delivery.
2
SlippyNunchucks hijacks Sogou Input Method to deploy DarkVigil malware
The SlippyNunchucks threat actor hijacked the Sogou Input Method branded vocabulary promotion mechanism to deploy DarkVigil implants targeting Chinese-speaking users in Asia and Europe.
One Click on a Malicious Link Lets Hackers Backdoor Sogou Input Method Users
Actively exploited one-click flaw in Sogou Input Method (CVE-2026-51990) let UNC3569 deploy the GRAYRABBIT espionage backdoor on Windows.
5
China-Linked Hackers Exploit Sogou One-Click RCE to Deploy GRAYRABBIT Backdoor
China-linked UNC3569 exploited CVE-2026-51990 in Sogou Input Method to deploy the GRAYRABBIT backdoor in active espionage intrusions.
6
China-Linked UNC3569 Exploited Sogou Input Method Flaw to Deploy GRAYRABBIT Backdoor
China-linked UNC3569 exploited a Sogou Input Method flaw to deploy GRAYRABBIT backdoor on Windows machines across East and Southeast Asia.