SlippyNunchucks hijacks Sogou Input Method DNS requests to deploy DarkVigil backdoor

What happened

ESET attributed a DNS hijacking operation to a China-aligned threat actor it calls SlippyNunchucks. The operation abused insecure HTTP communications in the Windows version of Sogou Input Method to deploy an implant called DarkVigil, also known as FDMTP. The Hacker News reports the campaign was observed starting July 1, 2026. Infosecurity Magazine says ESET published its research on November 4.

How the attack works

• A legitimate Sogou component, SGTool.exe, requests a brand-promotion configuration over HTTP from config.pinyin.sogou[.]com/api/brandScd/getBrandScd.php. The Hacker News
• In the observed attacks, DNS resolution of that domain was tampered with so it pointed to one of two staging servers: 47.239.250[.]102 (sogou-cdn[.]com) and 47.237.122[.]175 (dev.soft-png-cdn.com). The Hacker News
• The staging server returned a malicious configuration. It told the binary to download two payloads from sogou-cdn[.]com: a legitimate Adobe executable (biz_helper.exe) and a rogue DLL (libcef.dll) containing DarkVigil. The malware was launched through DLL sideloading. The Hacker News
• The implant was placed where Sogou’s own components would run it, which gave persistence without a separate mechanism. Infosecurity Magazine

About DarkVigil and the actor

• DarkVigil is a modular .NET toolset with more than 20 plugins. It uses Duplex Message Transport Protocol (DMTP) for command and control. The Hacker News
• SlippyNunchucks has been active since at least September 15, 2023. The Hacker News
• ESET assessed with high confidence that the group is tied to a nation-state surveillance effort aligned with Chinese government interests. Infosecurity Magazine
• FDMTP was previously linked to Mustang Panda. ESET found no tactical overlap and tracks SlippyNunchucks as a distinct intrusion set. The Hacker News
• Other apps abused to deliver DarkVigil include QuickFox, QingTalk, MiYunChat, SoftCam and tawk.to. Fortinet detailed a QuickFox supply chain compromise in August. The Hacker News
• ESET says the actor moved to Sogou three days after QuickFox released a clean version. The Hacker News

Victims

• Targets were in Hong Kong, Thailand, Japan, Vietnam, Oman and Sri Lanka. The Hacker News
• Reported victims include a multinational gambling organization operating from Sri Lanka, the Philippines and Hong Kong, an internet cafe in Dubai and a university student in Denmark. ESET gave no victim count. Infosecurity Magazine

Fix and open questions

• Following responsible disclosure, Tencent addressed the issue (CVE-2026-120422) in version 16.10, released October 29, 2026, by migrating the affected requests to HTTPS. The Hacker News
• Infosecurity Magazine adds that 16.10 also enabled certificate pinning. It reports ESET told Tencent on September 11 and Tencent acknowledged on September 21. Infosecurity Magazine
• ESET does not know where the DNS manipulation happened. It lists routers with malicious DNS settings, implanted routers, and interception at ISP level as possibilities. Infosecurity Magazine
• ESET says the downloader component still does not validate downloaded file types or restrict where files are saved. Infosecurity Magazine

A separate, earlier Sogou issue

Do not confuse this with CVE-2026-51990, a different, now-patched Sogou flaw. Gen Digital said UNC3569 exploited it in September 2026 to deliver a backdoor called GRAYRABBIT through a crafted link. The Hacker News

Am I affected?

You are potentially affected if you run the Windows version of Sogou Input Method older than 16.10. The first affected version is not confirmed in the sources.

Exposure also depends on whether your DNS traffic could be tampered with. The location of the hijacking is not confirmed.

Higher-risk groups are organizations and Chinese-speaking users in the countries listed above. The sources say the campaign was not limited to them, since they describe users reached across Asia and Europe. The Hacker News

Signs of compromise to look for:

• DNS lookups or HTTP requests from SGTool.exe that resolve config.pinyin.sogou[.]com to 47.239.250[.]102 or 47.237.122[.]175.
• Any connection to sogou-cdn[.]com or dev.soft-png-cdn.com.
• A biz_helper.exe (an Adobe executable) and a libcef.dll on a machine running Sogou. File paths are not confirmed in the sources.

What to do now

1. Update Sogou Input Method on Windows to version 16.10 or later. Treat any older build as exposed.
2. Search DNS, proxy and firewall logs since July 1, 2026 for the domains and IP addresses listed above. Block them.
3. Look for biz_helper.exe and libcef.dll alongside Sogou components on endpoints. If you find them, isolate the host and start incident response, because DarkVigil has plugins for persistence and data collection.
4. Check the DNS settings on your routers and endpoints for unexpected resolvers. Make sure config.pinyin.sogou[.]com resolves to legitimate Sogou addresses. ESET lists malicious router DNS settings as one possibility, so this step is a precaution.
5. Use trusted, encrypted DNS resolvers where possible, and make sure no unmanaged routers can silently alter DNS for corporate machines.
6. If you also use QuickFox, QingTalk, MiYunChat, SoftCam or tawk.to, review those hosts for the same indicators, since the actor abused those applications too.
7. Keep watching for updates. The downloader’s missing file type and path checks, and the unknown origin of the DNS hijack, remain open.

Sources

• The Hacker News: China-Aligned Hackers Hijack Sogou Input Method DNS Requests to Deploy DarkVigil Backdoor
• Infosecurity Magazine: China-Aligned Group Abuses Sogou Input Method to Deliver Malware