China-Aligned Hackers Hijack Sogou Input Method DNS Requests to Deploy DarkVigil Backdoor

A China-aligned threat actor known as SlippyNunchucks has been conducting a DNS hijacking campaign targeting the Windows version of Sogou Input Method. The operation exploits insecure HTTP communications within the software to intercept DNS requests. Starting July 1, 2026, the campaign has been used to deploy a backdoor implant called DarkVigil, also known as FDMTP. The campaign appears focused on surveillance objectives, targeting organizations through this supply-chain-adjacent attack vector. By abusing a widely-used Chinese input method application, the attackers can potentially reach a broad set of targets. The DNS hijacking technique allows the threat actor to redirect traffic and deliver malicious payloads without direct exploitation of a traditional vulnerability. This campaign highlights ongoing risks associated with insecure update or communication mechanisms in widely deployed software.