DNS redirection changes how a domain name resolves, causing a client to connect to an unexpected IP address or service. It can result from legitimate network controls, misconfiguration, compromised DNS infrastructure, or deliberate manipulation by an attacker.
In cyber attacks, redirecting a client to an attacker-controlled destination can enable interception or delivery of malicious content, especially when an application uses unencrypted HTTP and does not verify the response. In the Sogou Input Method scenario described in the article, DNS manipulation was identified as a possible way to alter the route to a configuration service; the exact point of manipulation was not established. Defenses include using HTTPS with certificate validation, securing DNS infrastructure, and monitoring for unexpected DNS responses or destinations.