hacker-news · Crawled Nov 5, 2026
China-Aligned Hackers Hijack Sogou Input Method DNS Requests to Deploy DarkVigil Backdoor
7 IoCs 1 Malware
Read original article ↗
AI Summary
China-aligned threat actor SlippyNunchucks conducted a DNS hijacking operation targeting users of the Sogou Input Method, exploiting insecure HTTP communications to redirect traffic to malicious servers. The attack delivered a backdoor called DarkVigil (aka FDMTP) via DLL sideloading using a legitimate Sogou component, SGTool.exe, and a rogue libcef.dll. The campaign targeted Chinese-speaking individuals and organizations in multiple countries, including Hong Kong, Thailand, Japan, and Sri Lanka, as part of a nation-state surveillance effort. Tencent patched the vulnerability as CVE-2026-120422 in version 16.10 by migrating HTTP requests to HTTPS.
AI-extracted · verify before operational use
Extracted Entities 1 found
Indicators of Compromise 7 extracted
MITRE ATT&CK TTPs 8 techniques
T1021.001 Remote Desktop Protocol · Lateral Movement T1053.005 Scheduled Task · Execution T1055 Process Injection · Defense Evasion T1059.007 JavaScript · Execution T1071 Application Layer Protocol · Command And Control T1071.001 Web Protocols · Command And Control T1112 Modify Registry · Defense Evasion T1204.002 Malicious File · Execution