China-Aligned Hackers Hijack Sogou Input Method DNS Requests to Deploy DarkVigil Backdoor

A China-aligned threat actor, known as SlippyNunchucks, has been linked to a DNS hijacking operation that exploits insecure HTTP communications in the Windows version of Sogou Input Method. This operation is part of a surveillance campaign aimed at deploying a backdoor implant called DarkVigil. The campaign is believed to have started on July 1, 2026, and appears to be targeting organizations. The attackers are using this method to abuse the Sogou Input Method's insecure communications. The ultimate goal of the campaign is to install the DarkVigil implant, also known as FDMTP, on compromised systems.