# ESET links Sogou DNS hijacking to DarkVigil surveillance campaign

_Published Wednesday, November 4, 2026 at 8:06 AM EST · Security · Latest · Tier 2 — Notable_

![ESET links Sogou DNS hijacking to DarkVigil surveillance campaign — Primary](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhMawvNNOvRYRm-k7ii9yDdw214v4kwQ7h5fAfOaUVkvMetNwArral8qumlObtaftjOcBsibL9vkqM1UT0-9l9jYPjj3M3C9NcPfg5pdIuENUfdKlK7lyseCS30AVhgLLs6a-2fdXlSDymSVeyIziO7IC13HFCaOf1v4sjbgmkeKfewWNsbTJCJ0WR2zLBZ/s1700-nu-rw-lo-l85-e365/key.jpg)

ESET has attributed a surveillance campaign using Sogou Input Method to the China-aligned group SlippyNunchucks, The Hacker News reported. Observed starting July 1, 2026, the campaign targeted organizations and Chinese-speaking individuals in Hong Kong, Thailand, Japan, Vietnam, Oman, and Sri Lanka.

Attackers tampered with DNS resolution to redirect the Windows application's unencrypted configuration requests to staging servers. Malicious configurations then instructed a legitimate Sogou component to download files that loaded the DarkVigil backdoor. The implant can run plugins for persistence or data collection.

Tencent addressed the vulnerability in Sogou version 16.10, released October 29, 2026, by moving the affected requests from HTTP to HTTPS.

## Sources

- [The Hacker News](https://thehackernews.com/2026/11/china-aligned-hackers-hijack-sogou.html)

---
Canonical: https://techandbusiness.org/newswire/-YcU1-BofE5PRHQ4wmJxc-
Published: 2026-11-04T13:06:17.685Z
Story chronology: 2026-11-04T11:24:00.000Z
Retrieved: 2026-11-04T22:05:23.485Z
Publisher: Tech & Business (techandbusiness.org)