
China-Aligned Hackers Hijack Sogou Input Method to Deploy DarkVigil Backdoor
Attackers abuse DNS hijacking in Sogou Input Method to deliver DarkVigil backdoor to Chinese-speaking users across Asia.
3
3 stories, newest first · one card per story

Attackers abuse DNS hijacking in Sogou Input Method to deliver DarkVigil backdoor to Chinese-speaking users across Asia.

China-linked UNC3569 actively exploited critical Sogou Input Method flaw CVE-2026-51990 for one-click system-level code execution, deploying the GrayRabbit backdoor.

UNC3569 actively exploits one-click RCE in Tencent Sogou Input Method to deploy the GrayRabbit backdoor, patched in version 16.3.0.3498.
Today 1.5K readers · 2.4K views · 754 reads · all time 189K views