https://feed.craftedsignal.io/actors/slippynunchucks/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 04 Nov 2026 13:05:05 +0000https://feed.craftedsignal.io/favicon-32x32.pnghttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svghttps://feed.craftedsignal.io/briefs/2026-11-sogou-hijack/Wed, 04 Nov 2026 13:05:05 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-sogou-hijack/The threat actor SlippyNunchucks has been attributed to a DNS hijacking operation abusing insecure HTTP communications in Windows versions of the Sogou Input Method to deploy an implant called DarkVigil.<p>The threat actor SlippyNunchucks is conducting a surveillance campaign by hijacking DNS requests within the Sogou Input Method. The attack exploits insecure HTTP communications used by the application to fetch configurations, redirecting requests to actor-controlled staging servers. This process enables the deployment of the DarkVigil (FDMTP) backdoor via DLL sideloading using the legitimate component SGTool.exe. ESET identified this activity, noting that the campaign targets organizations and individuals across Hong Kong, Thailand, Japan, Vietnam, Oman, and Sri Lanka.</p> highthreatsupply-chaindns-hijackingdll-sideloadingcyber-espionage