DNS hijacking discovered by China-aligned hackers

A group of hackers linked to China has launched a DNS hijacking operation targeting the Sogou Input Method. This operation is attributed to the threat group SlippyNunchucks and is part of a broader surveillance campaign. The attacks exploit insecure HTTP communications in Windows versions of the Sogou Input Method to implement an implant called DarkVigil.

The campaign was first observed on July 1, 2026, and has since focused on various organizations. The attackers exploit vulnerabilities in the DNS architecture to manipulate communication between users and servers. This allows them to inject malicious software used for surveillance purposes.

Technical Details of the Attack

The attackers aim to redirect the DNS requests of the Sogou Input Method to gain control over the data streams. This technique enables them to spoof legitimate requests and redirect users to malicious servers. The use of insecure HTTP connections makes the attacks particularly effective as they bypass user security measures.

DarkVigil, also known as FDMTP, is an implant specifically designed to steal data and monitor user activities. The malware may be capable of recording keystrokes, taking screenshots, and collecting other sensitive information. The threat posed by DarkVigil is particularly concerning as it can nest undetected within the system.

The Sogou Input Method is widely used software for inputting Chinese characters and is utilized by millions of users worldwide. The popularity of this software makes it an attractive target for cyberattacks. The attackers leverage its widespread use to reach a larger number of victims and expand their surveillance objectives.

Reactions and Security Measures

The discovery of these attacks has raised concerns among security experts, who emphasize the need to improve security protocols for software like the Sogou Input Method. Experts recommend transitioning to secure communication protocols to minimize the risk of DNS hijacking. Using HTTPS instead of HTTP can help ensure the integrity of data transmission.

The affected organizations are urged to check their systems for signs of compromise and take appropriate measures to protect their networks. This includes implementing Intrusion Detection Systems (IDS) and conducting regular security audits. Raising user awareness about the risks of insecure connections is also an important step in improving cybersecurity.

The threat posed by SlippyNunchucks and the use of DarkVigil highlight the ongoing challenges in the field of cybersecurity. Given the increasing complexity and sophistication of cyberattacks, both businesses and individuals must remain vigilant and take proactive measures to protect their data.