Tencent Sogou Input Method DNS Hijacking and DarkVigil Deployment
The threat actor SlippyNunchucks has been attributed to a DNS hijacking operation abusing insecure HTTP communications in Windows versions of the Sogou Input Method to deploy an implant called DarkVigil.
Triage facts
Revision 1- Evidence
- Confirmed activeHigh confidence
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 4, 13:05 UTC
- Source quality
- D2Likely
The threat actor SlippyNunchucks is conducting a surveillance campaign by hijacking DNS requests within the Sogou Input Method. The attack exploits insecure HTTP communications used by the application to fetch configurations, redirecting requests to actor-controlled staging servers. This process enables the deployment of the DarkVigil (FDMTP) backdoor via DLL sideloading using the legitimate component SGTool.exe. ESET identified this activity, noting that the campaign targets organizations and individuals across Hong Kong, Thailand, Japan, Vietnam, Oman, and Sri Lanka.