VULNpocalypse
HighSupply chainPatch available

Sogou Input Method update hijack installs DarkVigil backdoor; update to 16.10 (CVE-2026-120422)

A China-aligned group hijacked DNS to push the DarkVigil implant through Sogou Input Method’s plain HTTP requests; Tencent fixed it in version 16.10.

Published
Updated
Fixed in
Sogou Input Method 16.10 (moves affected requests to HTTPS and enables certificate pinning)
Exploitation
Yes, ESET reports DarkVigil delivered to victims in six countries since July 1, 2026 through DNS hijacking of Sogou update traffic

What happened

ESET Research, which tracks the actor as SlippyNunchucks, published its findings on November 4, 2026. The group abused update traffic of Sogou Input Method to quietly install the DarkVigil implant. Tencent, which owns Sogou, has patched the flaw in version 16.10 (GBHackers). The issue now has the ID CVE-2026-120422 (Cyber Security News); see the NVD entry. ESET’s CNA assigned the ID on November 2 (GBHackers).

How the attack works

  • From July 1, 2026, victims in Hong Kong, Thailand, Japan, Vietnam, Sri Lanka and Oman received DarkVigil while using the keyboard. ESET found DNS hijacking rather than a software exploit, because the app uses unencrypted HTTP for some requests (GBHackers).
  • Where the DNS manipulation happens is still unknown. ESET suspects compromised routers or interception at the ISP level (GBHackers).
  • The Sogou component SGTool.exe requests a configuration from config.pinyin.sogou[.]com/api/brandScd/getBrandScd.php. ESET found 20 endpoints on that host that the app reaches over plain HTTP, even though the domain supports HTTPS (GBHackers).
  • On victim networks, the attacker resolved the domain to staging servers at 47.239.250[.]102 or 47.237.122[.]175. They returned a forged AES-encrypted configuration with altered MD5 values, so the integrity check passed (GBHackers).
  • The configuration told SGTool.exe to download two files from sogou-cdn[.]com: a legitimate, signed Adobe Licensing WF Helper renamed biz_helper.exe, and the malicious libcef.dll (GBHackers).
  • In one path, the Adobe binary replaces SogouComMgr.exe, so any component install or load launches it and side-loads the DLL. In the other, the files sit in the biz_center directory and run when the BizCenterCom component loads. No separate persistence is needed, though either method can crash the software (GBHackers).

About DarkVigil

DarkVigil, also known as FDMTP, is a modular .NET toolset with more than 20 plugins, built on the TouchSocket framework. The group has been active since at least September 2023 (GBHackers). It communicates over the Duplex Message Transport Protocol (DMTP). The server pushes plugins, which are stored compressed in the registry under HKCU\Software\Microsoft\IME and loaded in memory (GBHackers). Stolen data is managed through a web panel branded “Vigil” (Cyber Security News).

Attribution and targets

ESET does not link the group to Mustang Panda, even though some public reports do. Victims include a gambling operator in Sri Lanka, the Philippines and Hong Kong, an Internet café in Dubai, and a student in Denmark (GBHackers). ESET judges with high confidence that the group works in line with Chinese government interests (Cyber Security News).

Disclosure timeline

ESET reported the weakness on September 11, and Tencent acknowledged it on September 21 (GBHackers).

Separate campaign, same week

A different campaign is not linked to Sogou in these sources. Microsoft’s November 3 investigation, as reported by GBHackers, describes trojanized installers disguised as popular games, cracked software and utilities. They deliver multiple monetization “offers” in one session: WorldProxyPool proxyware, CharityEngine and BOINC distributed-computing software, and Advanced Windows Manager utilities (GBHackers).

Am I affected?

You are potentially affected if you run Sogou Input Method on Windows below version 16.10 (the exact affected version range is not confirmed in the sources) and your DNS traffic could be tampered with, for example through a compromised router or ISP-level interception. Confirmed victims were in Hong Kong, Thailand, Japan, Vietnam, Sri Lanka and Oman (GBHackers).

Signs of compromise:

  • Connections to sogou-cdn[.]com, 47.239.250[.]102 or 47.237.122[.]175.
  • A renamed biz_helper.exe, or odd Adobe-named files, in Sogou directories such as the Components folder.
  • Unexpected libcef.dll files.
  • Plugin data under HKCU\Software\Microsoft\IME.
  • DarkVigil bootstrap infrastructure: blog.wangmengfun[.]top, update.mssproxy[.]net and img.fusfun[.]top (Cyber Security News).

Cyber Security News also lists additional hosting and staging indicators, including 47.86.15[.]162, 47.236.254[.]159 and dev.soft-png-cdn[.]com, plus SHA-1 hashes (Cyber Security News).

For the separate fake installer campaign, check for WorldProxyPool, CharityEngine, BOINC, VirtualBox and AW Manager that were not authorized (GBHackers).

What to do now

  1. Update Sogou Input Method to version 16.10 or later. It moves the affected requests to HTTPS and enables certificate pinning (GBHackers).
  2. Hunt for the indicators above: sogou-cdn[.]com, the two staging IPs, a renamed biz_helper.exe in Sogou directories, and unexpected libcef.dll files (GBHackers).
  3. Check router and DNS settings for unauthorized changes, and secure routers (GBHackers).
  4. If you find a match, treat the host as compromised. Remove the files and investigate the registry plugin storage. Specific cleanup steps are not confirmed in the sources.
  5. For the fake installer campaign, prohibit untrusted software sources, investigate unexpected installations, and review scheduled tasks tied to WorldProxyPool, which runs three tasks as SYSTEM (GBHackers).
  6. Enable potentially unwanted application protection and keep Defender real-time and behavior monitoring on, as Microsoft recommends (GBHackers).
  7. Prefer behavioral hunting over domain blocklists, since the fake installer infrastructure rotates frequently (GBHackers).

Sources