China-linked group exploits Sogou Input Method communications to deploy backdoor
China-linked group SlippyNunchucks exploited DNS requests and unencrypted communications from Sogou Input Method and other software to deploy the DarkVigil backdoor. Victims were identified in Hong Kong, Thailand, Japan, Vietnam, Sri Lanka, Oman and elsewhere, including institutions, Chinese-speaking users and multinational gambling companies. The cyber-attack campaign was disclosed on 4 November.
Key facts
- Affected organisation
- Being confirmed
- Incident type
- Malware
- Occurred / detected
- Not confirmed
- Scale of damage
- Backdoor deployed to institutions, Chinese-speaking users and multinational gambling companies across multiple countries
- Cause / method
- Manipulation of DNS requests and exploitation of unencrypted communications redirected legitimate traffic to malicious servers to install the DarkVigil backdoor
- Location
- Other countries
Timeline
- A campaign deploying the DarkVigil backdoor by exploiting DNS requests and unencrypted communications from Sogou Input Method and other software was disclosed.
2 related reports
The summary and key facts are written by AI from related reports and may contain errors. Check the original articles and the organisation’s official statements for accurate details.