[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fThno_n3FV88z-NCmgiNvnIrJx5L_9s-higAb2g7TxCA":3},{"article":4,"iocs":53,"watch_terms":68,"solutions":69,"lesson":161},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"f0b2edcc-175b-4227-9daf-0a8e823cfb81","Hackers Turn Popular Chinese Keyboard Software Into a Backdoor for Cyberespionage Attacks","hackers-turn-popular-chinese-keyboard-software-into-a-backdoor-for-cyberespionag-ba4f20","A China-aligned hacking group is abusing Sogou Input Method, one of the most popular Chinese typing tools, to secretly install a backdoor called DarkVigil on Windows computers. The group is tracked as SlippyNunchucks. Since July 1, 2026, it has used the keyboard software to reach users in Hong Kong, Thailand, Japan, Vietnam, Sri Lanka and […] The post Hackers Turn Popular Chinese Keyboard Software Into a Backdoor for Cyberespionage Attacks appeared first on Cyber Security News.","A China-aligned threat actor, SlippyNunchucks, is exploiting a DNS hijacking vulnerability in the popular Sogou Input Method software to deploy a backdoor named DarkVigil. This technique bypasses the need for traditional exploits by redirecting legitimate software update requests to attacker-controlled servers, allowing for the installation of the malware. The backdoor, also known as FDMTP, is a modular .NET toolset with over 20 plugins and communicates via the Duplex Message Transport Protocol (DMTP).","Hackers use Sogou Input Method to install DarkVigil backdoor on Windows.","https:\u002F\u002Fcybersecuritynews.com\u002Fchinese-keyboard-software\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002FHackers-Turn-Popular-Chinese-Keyboard-Software-Into-a-Backdoor-for-Cyberespionage-Attacks.webp","2026-11-05T14:59:57+00:00","2026-11-05T16:00:27.713675+00:00",8,[17,20,23,26,28],{"name":18,"type":19},"Sogou Input Method","product",{"name":21,"type":22},"SlippyNunchucks","threat_actor",{"name":24,"type":25},"Tencent","vendor",{"name":27,"type":19},"SGTool.exe",{"name":29,"type":19},"biz_helper.exe","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":30,"icon":32,"name":33,"slug":34},null,"Malware","malware",[36,41,46,48],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":42},{"id":43,"icon":32,"name":44,"slug":45},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":47},{"id":30,"icon":32,"name":33,"slug":34},{"category":49},{"id":50,"icon":32,"name":51,"slug":52},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[54,58,62,65],{"type":55,"value":56,"context":57},"domain","config.pinyin.sogou[.]com","Domain used by Sogou Input Method for fetching settings, which was hijacked by attackers.",{"type":59,"value":60,"context":61},"cve","CVE-2026-120422","Vulnerability ID related to the Sogou Input Method DNS hijacking issue.",{"type":34,"value":63,"context":64},"DarkVigil","Backdoor malware deployed by SlippyNunchucks.",{"type":34,"value":66,"context":67},"FDMTP","Alternative name for the DarkVigil malware.",[24,18,27],{"controls":70,"vendors":154},[71,99,125],{"slug":72,"name":73,"problem":74,"products":75},"patch-management","Automated patch management","Known holes get closed in days, not months.",[76,84,91],{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":72,"product_name":88,"url":89,"description":90},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":95,"product_name":96,"url":97,"description":98},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"slug":100,"name":101,"problem":102,"products":103},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[104,112,117],{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":113,"product_name":114,"url":115,"description":116},"defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"slug":126,"name":127,"problem":128,"products":129},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",[130,138,146],{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"zscaler","Zscaler","\u002Fvendor-logos\u002Fzscaler.png","zscaler-internet-access","Zscaler Internet Access","https:\u002F\u002Fwww.zscaler.com\u002Fproducts-and-solutions\u002Fzscaler-internet-access","Cloud secure web gateway with DNS security, inspection and data protection.",{"vendor_slug":139,"vendor_name":140,"vendor_logo":141,"product_slug":142,"product_name":143,"url":144,"description":145},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-gateway","Cloudflare Gateway","https:\u002F\u002Fwww.cloudflare.com\u002Fproducts\u002Fgateway\u002F","DNS filtering and secure web gateway.",{"vendor_slug":147,"vendor_name":148,"vendor_logo":149,"product_slug":150,"product_name":151,"url":152,"description":153},"netskope","Netskope","\u002Fvendor-logos\u002Fnetskope.png","netskope-swg","Netskope Secure Web Gateway","https:\u002F\u002Fwww.netskope.com\u002Fproducts\u002Fnext-gen-swg","Cloud secure web gateway with inspection of web and cloud app traffic.",[155],{"slug":156,"name":157,"logo_path":158,"roles":159},"eset","ESET","\u002Fvendor-logos\u002Feset.png",[160],"reported_by",{"slug":162,"title":163,"body":164,"framework_refs":165,"framework_notes":173},"dns-hijacking-turns-sogou-keyboard-updates-into-a-malware-delivery-channel","DNS Hijacking Turns Sogou Keyboard Updates Into a Malware Delivery Channel","The SlippyNunchucks threat actor exploited a DNS hijacking vulnerability in Sogou Input Method software to redirect legitimate update requests to attacker-controlled servers, silently installing the DarkVigil backdoor without requiring any user interaction or traditional exploit. This attack abuses the inherent trust users and systems place in software update mechanisms, turning a routine process into a stealthy compromise vector. The modular nature of the DarkVigil\u002FFDMTP toolset — with over 20 plugins — means attackers can expand their foothold in highly flexible ways once installed. This matters because widely deployed input software represents a broad, often overlooked attack surface, particularly in enterprise environments where such tools are rarely scrutinized for security risks.",[166,167,168,169,170,171,172],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","MITRE ATT&CK T1566: Phishing","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIS2 Article 21(2)(b)","CIS Control 17: Incident Response Management",{"NIS2 Article 21(2)(b)":174,"MITRE ATT&CK T1566: Phishing":175,"NIST SP 800-53 SI-2: Flaw Remediation":176,"CIS Control 17: Incident Response Management":177,"CIS Control 7: Continuous Vulnerability Management":178,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":179,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":180},"NIS2 requires organizations to implement supply chain security measures, including assessing the security practices of software suppliers, which would have flagged Sogou's insecure update mechanism as an unacceptable risk.","While not phishing in the traditional sense, the attack mirrors the same supply chain abuse pattern documented under ATT&CK's techniques for delivering malware through trusted software channels (specifically T1195: Supply Chain Compromise), highlighting the need to monitor and validate trusted delivery mechanisms.","SI-2 requires organizations to identify, report, and correct software flaws in a timely manner, which would have driven assessment and patching of the vulnerable Sogou update channel.","A mature incident response capability with pre-defined playbooks for supply chain compromise scenarios would have accelerated detection and containment of the DarkVigil backdoor once anomalous DNS or network activity was observed.","The DNS hijacking vulnerability in Sogou's update mechanism could have been identified through continuous vulnerability scanning of third-party software, prompting remediation before attackers exploited it.","This control mandates timely identification and remediation of technical vulnerabilities in software, including third-party tools like Sogou, which would have surfaced the DNS hijacking risk before exploitation.","Enforcing strict controls on which servers software is permitted to contact for updates — analogous to identity-based trust decisions — would have prevented the rogue DNS-redirected update server from being treated as legitimate."]