China-Aligned Hackers Hijack Sogou Input Method DNS Requests to Deploy Dark Vigil Backdoor
Summary: ESET attributes a DNS hijacking campaign to a China-aligned actor it calls SlippyNunchucks, which tampered with DNS resolution for the Sogou Input Method's config.pinyin.sogou[.]com endpoint to route HTTP requests to staging servers and deliver the DarkVigil backdoor via DLL sideloading through SGTool.exe. Observed from July 1, 2026, the campaign targeted organizations and Chinese-speaking individuals in Hong Kong, Thailand, Japan, Vietnam, Oman, and Sri Lanka, and Tencent fixed the flaw (CVE-2026-120422) in version 16.10 on October 29, 2026 by moving the affected requests to HTTPS.
What you should know: The delivery path was a legitimate, signed Tencent component making a routine HTTP configuration request, so the compromise left no malicious binary to flag until the sideloaded payload arrived. ESET also reports significant surveillance against an organization running Chinese-language online betting platforms in Sri Lanka, Hong Kong, and the Philippines, a reminder that the targeting here followed specific business interests rather than random opportunity.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Mentions
- CVE-2026-120422
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026