cyber.hendryadrian.com
Threat Research · welivesecurity.com

ESET Details SlippyNunchucks’ Sogou Input Method Hijack to Deploy DarkVigil

· Original article ↗

Summary

ESET details how SlippyNunchucks allegedly hijacked Sogou Input Method’s insecure HTTP traffic to deliver DarkVigil via a malicious configuration. The DNS manipulation point remains unknown; Tencent fixed the issue in version 16.10.

Key points

  • ESET observed DarkVigil deployments through Sogou Input Method beginning July 1, 2026, affecting organizations and Chinese-speaking users in several Asian countries.
  • Attackers redirected DNS for config.pinyin.sogou[.]com to staging servers, which supplied a malicious configuration through an HTTP request.
  • The configuration downloaded a disguised Adobe binary and DarkVigil’s libcef.dll, using Sogou component-loading workflows to execute the implant.
  • The precise point where DNS manipulation occurs remains unknown; ESET lists compromised routers or ISP-level interception as possibilities.
  • ESET analyzed DarkVigil’s DMTP communications, including its reverse RPC mechanism and plugin delivery and execution.
  • Tencent addressed the issue in Sogou Input Method version 16.10 by migrating affected requests to HTTPS and enabling certificate pinning.

Article Details

Attack Vectors
  • SlippyNunchucks hijacked DNS resolution for Sogou Input Method’s configuration host, directing unencrypted HTTP requests for the brand-promotion configuration to attacker-controlled staging servers; where the DNS manipulation occurred remains unknown.
  • The malicious configuration instructed SGTool.exe to download a disguised Adobe binary and the DarkVigil implant, placing them in locations used by Sogou Input Method’s component-management and loading workflows.
  • The disguised Adobe binary side-loaded libcef.dll, executing the DarkVigil implant. The article reports that these existing component workflows provided persistence without a separate persistence mechanism.
Defensive Notes
  • Tencent released Sogou Input Method version 16.10 to migrate affected HTTP requests to HTTPS and enforce TLS certificate validation; the article also reports certificate pinning was enabled.
  • The article identifies insecure HTTP communication in Sogou Input Method’s brand-promotion configuration retrieval as the weakness exploited in the DNS hijacking operation.

Indicators of compromise

TypeIndicatorContext
DOMAINblog[.]wangmengfun[.]topListed as a DarkVigil bootstrap domain.
DOMAINdev[.]soft-png-cdn[.]comListed as a hijacking domain and staging server for DarkVigil.
DOMAINimg[.]fusfun[.]topListed as a DarkVigil bootstrap server.
DOMAINsogou-cdn[.]comAttacker-controlled domain used to serve malicious configuration and payloads from staging servers.
DOMAINupdate[.]mssproxy[.]netListed as a DarkVigil bootstrap server.
IPV447[.]236[.]254[.]159Listed as a hijacking domain and staging server for DarkVigil.
IPV447[.]237[.]122[.]175Attacker-controlled staging server that served sogou-cdn[.]com and malicious configuration and payloads.
IPV447[.]239[.]250[.]102Attacker-controlled staging server that served sogou-cdn[.]com and malicious configuration and payloads.
IPV447[.]86[.]15[.]162Listed as a DarkVigil bootstrap server.
SHA13e16ba611782af6e45576d390488d28fd676badeHash of a file identified in the IoC table as a DarkVigil implant.
SHA18a60a8e90e1f5f08f28fe5a6dd57bd686c20dc23Hash of the libcef.dll file identified as a DarkVigil implant.

MITRE ATT&CK

T1036.005 · Match Legitimate Resource Name or LocationThe malicious configuration placed the legitimate Adobe binary under the SogouComMgr.exe name and component locations.T1041 · Exfiltration Over C2 ChannelDarkVigil can use DMTP to exfiltrate data to its C&C server.T1071.001 · Web ProtocolsThe article identifies HTTP as a protocol DarkVigil uses to connect to its bootstrap server.T1105 · Ingress Tool TransferThe malicious Sogou Input Method configuration instructed SGTool.exe to download the disguised binary and DarkVigil implant; DarkVigil can also receive plugins from its C&C server.T1112 · Modify RegistryDarkVigil stores compressed plugin binaries in HKCU\Software\Microsoft\IME\<HWID>\pluginHash.T1557 · Adversary-in-the-MiddleThe attacker controlled DNS resolution of config.pinyin.sogou[.]com in victim environments.T1573 · Encrypted ChannelThe article identifies DarkVigil’s C&C messages as encrypted.T1574.001 · DLLThe disguised Adobe binary side-loaded the malicious libcef.dll implant.T1659 · Content InjectionSlippyNunchucks used DNS hijacking to redirect Sogou Input Method’s HTTP request and deliver a malicious configuration.

CVE

CVE-2026-120422Sogou · Sogou Input Method2026-11-02: ESET CNA issued a CVE ID for the vulnerability (CVE-2026-120422).

Threat Actors

SlippyNunchucksESET tracks this China-aligned threat actor as responsible for deploying the DarkVigil toolset, including the reported DNS hijacking operation that abused Sogou Input Method. ESET assesses with high confidence that the group is associated with a nation-state surveillance effort aligned with Chinese government interests.

Malware

DarkVigilAt ESET, we have been tracking the DarkVigil toolset (also known as FDMTP) and its operator, the SlippyNunchucks threat actor, since 2025.

Vendors

SogouShortly after the supply-chain compromise ended, SlipplyNunchucks shifted to abusing Sogou Input Method to deploy DarkVigil.TencentAfter uncovering the operation, we contacted the Tencent Security Response Center to report the abuse and share our findings.

Products

Tencent Sogou Input MethodShortly after the supply-chain compromise ended, SlipplyNunchucks shifted to abusing Sogou Input Method to deploy DarkVigil.

Countries

AustriaOccasionally, the group targeted victims in Europe, including individuals in Germany, Russia, the UK, and Austria.ChinaSlippyNunchucks is a China-aligned threat actor that has been active since at least September 15th, 2023.DenmarkNotable victims include a multinational gambling organization that operates out of Sri Lanka, the Philippines, and Hong Kong; an Internet café in Dubai; and a university student in Denmark.GermanyOccasionally, the group targeted victims in Europe, including individuals in Germany, Russia, the UK, and Austria.Hong KongIn our telemetry, we observed that this operation targeted organizations and Chinese-speaking individuals in Hong Kong, Thailand, Japan, Vietnam, Oman, and Sri Lanka.JapanIn our telemetry, we observed that this operation targeted organizations and Chinese-speaking individuals in Hong Kong, Thailand, Japan, Vietnam, Oman, and Sri Lanka.OmanIn our telemetry, we observed that this operation targeted organizations and Chinese-speaking individuals in Hong Kong, Thailand, Japan, Vietnam, Oman, and Sri Lanka.PhilippinesNotable victims include a multinational gambling organization that operates out of Sri Lanka, the Philippines, and Hong Kong; an Internet café in Dubai; and a university student in Denmark.RussiaOccasionally, the group targeted victims in Europe, including individuals in Germany, Russia, the UK, and Austria.Sri LankaIn our telemetry, we observed that this operation targeted organizations and Chinese-speaking individuals in Hong Kong, Thailand, Japan, Vietnam, Oman, and Sri Lanka.ThailandIn our telemetry, we observed that this operation targeted organizations and Chinese-speaking individuals in Hong Kong, Thailand, Japan, Vietnam, Oman, and Sri Lanka.United KingdomOccasionally, the group targeted victims in Europe, including individuals in Germany, Russia, the UK, and Austria.VietnamIn our telemetry, we observed that this operation targeted organizations and Chinese-speaking individuals in Hong Kong, Thailand, Japan, Vietnam, Oman, and Sri Lanka.

Related Articles