DNS Hijacking Discovered by SlippyNunchucks

A threat actor known as SlippyNunchucks, linked to China, has initiated an operation to hijack Domain Name System (DNS) requests. These attacks exploit insecure HTTP communications in the Windows version of the Sogou Input Method. The campaign was first observed on July 1, 2026, and aims to spread an implant known as DarkVigil (also referred to as FDMTP). The attackers leverage vulnerabilities in the Sogou Input Method to redirect DNS requests.

This allows them to install malicious software on the target systems. The Sogou Input Method is a widely used input method in China, utilized by millions of users, significantly increasing the reach of the attacks. Analyses indicate that the attacks are specifically targeting organizations across various sectors, including education, technology, and government agencies. The background of the attacks suggests a comprehensive surveillance strategy aimed at collecting sensitive information and compromising network security. The DarkVigil backdoor enables the attackers to gain complete control over the compromised systems.

This type of malware can steal data, activate surveillance functions, and load additional malicious software. Experts warn that the threat posed by such implants has significantly increased in the current cyber landscape. The security community has already taken measures to mitigate the impact of these attacks. Companies are strongly advised to check their systems for the latest security updates and ensure that all software versions in use are up to date. In particular, users of the Sogou Input Method should monitor their systems for signs of compromise.

The discovery of these attacks has also sparked increased discussion about the need for more secure communication protocols. Experts emphasize that using HTTPS instead of HTTP is crucial to preventing such attacks. Implementing security measures could help reduce the attack surface for threat actors like SlippyNunchucks. The Chinese government has yet to comment on the allegations. The international community is closely monitoring the situation, as such cyberattacks could have far-reaching implications for global security.

Reactions to these incidents could also influence diplomatic relations between China and other countries. The vulnerability exploited by these attacks could also affect other software products that use similar insecure communication protocols. Companies are urged to review and adjust their security policies as necessary to prevent future attacks. The exact number of affected systems is currently unclear. The SlippyNunchucks campaign is another example of the growing threat posed by state-sponsored hacker groups.

The attacks highlight the necessity for companies to take proactive security measures and prepare for potential cyber threats. Security research will continue to be pursued intensively to better understand the methods of these attackers. Security authorities recommend conducting regular cybersecurity training for employees to raise awareness of such threats. Implementing multi-factor authentication processes can also help enhance security. The attacks by SlippyNunchucks serve as a wake-up call for many organizations to reassess their security strategies.

The campaign is being monitored, and security researchers are working to decipher the exact techniques and tactics of the attackers. The threat posed by DarkVigil remains, and further information about the attacks is expected to be released in the coming weeks. The vulnerability exploited by these attacks is a serious issue that requires immediate attention. The vulnerability in the Sogou Input Method could potentially affect millions of users, underscoring the urgency of the situation. Experts estimate that the number of affected systems may continue to rise in the coming weeks as the attackers expand their campaign.