China-Aligned Hackers Hijack Popular Sogou Keyboard Software to Secretly Install DarkVigil Malware
ID: 2c253dbe-9181-50dd-8cf9-5896efc3f087
STIX ID: report--2c253dbe-9181-50dd-8cf9-5896efc3f087
Feed Name: GBHackers
Threat Score
ESET reports that a China-aligned espionage actor (SlippyNunchucks) abused unencrypted Sogou Input Method update traffic via DNS hijacking and side‑loading to deploy the modular .NET implant DarkVigil (FDMTP) across multiple countries; Tencent patched the issue in version 16.10 and ESET published IOCs and a CVE (CVE-2026-120422) with recommended mitigations.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.