A newly reported cyber-espionage campaign has drawn attention to a familiar but still costly business risk: software that communicates insecurely over the internet. According to reporting cited in the source, a China-aligned threat actor known as SlippyNunchucks abused insecure HTTP communications in Windows versions of Sogou Input Method as part of a DNS hijacking operation used to deploy a backdoor called DarkVigil.

While the reported activity appears to be focused on surveillance, the underlying issue is broader than one product or one region. For European organisations, the incident is a practical reminder to review third-party desktop software, outbound network controls, software update mechanisms and detection capabilities for suspicious DNS and HTTP traffic.

What happened

According to the source, security researchers attributed the activity to SlippyNunchucks, a China-aligned threat actor. The campaign was observed from 1 July 2026 and reportedly targeted organisations and individuals through abuse of insecure HTTP communications in Windows versions of Sogou Input Method.

The reported technique involved hijacking DNS-related requests and using that access to deliver an implant known as DarkVigil, also referred to as FDMTP. Based on the source material, this was described as a surveillance-oriented campaign rather than a financially motivated ransomware incident.

The key technical point for business readers is not only the malware itself, but the delivery path: if a desktop application makes sensitive requests over unencrypted HTTP instead of HTTPS, attackers may have more opportunities to tamper with traffic, redirect requests or insert malicious responses.

Why it matters for European businesses

Even if a company does not use Sogou Input Method, the security lesson is relevant. Many organisations rely on niche utilities, language input tools, browser add-ons and other endpoint software that may not go through the same procurement and security review as core business applications.

For European businesses, there are several practical concerns:

• Third-party software risk: Smaller desktop tools can create a route into corporate devices if they use weak update or communication mechanisms.
• Traffic integrity: Applications still using HTTP for downloads, updates or configuration requests can expose users to tampering on untrusted or compromised networks.
• Espionage exposure: Surveillance-focused malware may aim to steal documents, credentials, communications or operational data rather than trigger immediate disruption.
• Supply chain implications: Security teams need to evaluate not only major SaaS providers but also local software, plug-ins, input methods and region-specific applications used by staff or contractors.
• Compliance and resilience: Businesses subject to cybersecurity obligations, including sectors preparing for or operating under NIS2-related requirements, should treat insecure software communications as a governance and risk-management issue.

The case also reinforces a broader point: endpoint compromise does not always begin with a phishing email. Weaknesses in software design, network trust assumptions and insufficient encryption can provide a quieter path into company systems.

Who may be affected

The most immediate exposure is likely to organisations or users running affected Windows versions of Sogou Input Method, especially in environments where the tool is used for Chinese-language input. This may include:

• European companies with offices, suppliers or employees working with Chinese-language systems
• Manufacturers, logistics firms and trading businesses operating across Europe and Asia
• Professional services firms handling sensitive commercial or legal information
• IT teams managing multilingual Windows endpoints
• Organisations with limited control over installed desktop utilities on employee devices

Companies may face elevated risk if they allow unmanaged software installation, lack DNS monitoring, permit unrestricted outbound connections or have limited visibility into endpoint network activity.

What companies should consider

• Inventory affected software: Check whether Sogou Input Method is installed on any corporate Windows devices, including contractor or subsidiary systems.
• Review software communications: Identify applications that still use HTTP for updates, configuration or other sensitive requests, and prioritise their removal, replacement or containment.
• Restrict outbound traffic: Use web filtering, DNS monitoring and egress controls to reduce opportunities for suspicious redirection or malware retrieval.
• Harden endpoint management: Limit local admin rights and tighten policies on user-installed utilities, browser extensions and input tools.
• Monitor for stealthy compromise: Look for unusual DNS behaviour, unexpected HTTP requests from desktop applications and signs of persistence associated with backdoor activity.
• Segment sensitive environments: Devices handling finance, executive communications, customer data or regulated information should have stricter software controls and monitoring.
• Engage suppliers and regional teams: If multilingual or region-specific software is necessary, ensure procurement and IT security teams assess its update and transport security model.

The source describes an active espionage campaign, but the wider business takeaway is defensive and immediate: organisations should not assume that smaller desktop tools are low risk. Software that communicates insecurely can become an entry point for targeted intrusion, especially in internationally connected business environments.