{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/actors/slippynunchucks/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":["SlippyNunchucks"],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":true,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":[],"_cs_severities":["high"],"_cs_tags":["supply-chain","dns-hijacking","dll-sideloading","cyber-espionage"],"_cs_type":"threat","_cs_vendors":[],"content_html":"\u003cp\u003eThe threat actor SlippyNunchucks is conducting a surveillance campaign by hijacking DNS requests within the Sogou Input Method. The attack exploits insecure HTTP communications used by the application to fetch configurations, redirecting requests to actor-controlled staging servers. This process enables the deployment of the DarkVigil (FDMTP) backdoor via DLL sideloading using the legitimate component SGTool.exe. ESET identified this activity, noting that the campaign targets organizations and individuals across Hong Kong, Thailand, Japan, Vietnam, Oman, and Sri Lanka.\u003c/p\u003e\n","date_modified":"2026-11-04T13:05:05Z","date_published":"2026-11-04T13:05:05Z","id":"https://feed.craftedsignal.io/briefs/2026-11-sogou-hijack/","summary":"The threat actor SlippyNunchucks has been attributed to a DNS hijacking operation abusing insecure HTTP communications in Windows versions of the Sogou Input Method to deploy an implant called DarkVigil.","title":"Tencent Sogou Input Method DNS Hijacking and DarkVigil Deployment","url":"https://feed.craftedsignal.io/briefs/2026-11-sogou-hijack/"}],"language":"en","title":"CraftedSignal Threat Feed - SlippyNunchucks","version":"https://jsonfeed.org/version/1.1"}