This operation leveraged a Domain Name System (DNS) hijacking technique, exploiting vulnerabilities within the insecure HTTP communications present in Sogou Input Method running on Windows operating systems. Security assessments indicate that this campaign commenced on July 1, 2026, and its targets included various organizations.
The utilization of DNS hijacking, combined with the exploitation of insecure HTTP channels within a widely used software component like Sogou Input Method, presents a significant vector for initial access and persistence establishment in enterprise environments. This incident highlights the risks associated with software dependencies and communication protocols within endpoint security postures.
Why it matters
This highlights a critical vulnerability in widely used software, demonstrating how input methods can become vectors for sophisticated surveillance. Operators must assess the risk posed by third-party software dependencies that handle network requests.
