SlippyNunchucks Uses Sogou DNS Hijacking to Deliver DarkVigil
Summary
ESET attributes a surveillance campaign to SlippyNunchucks, which tampered with DNS responses for Sogou Input Method’s HTTP configuration requests to deliver DarkVigil. Tencent patched the issue in version 16.10 (CVE-2026-120422).
Key points
- ESET says the campaign, observed from July 1, 2026, targeted organizations and Chinese-speaking individuals across parts of Asia.
- DNS tampering redirected Sogou Input Method’s HTTP configuration request to staging servers, where a malicious configuration prompted payload downloads and DLL sideloading via SGTool.exe.
- The affected configuration endpoint was config[.]pinyin[.]sogou[.]com/api/brandScd/getBrandScd.php; the article also names sogou-cdn[.]com as a payload source.
- DarkVigil is a modular .NET framework with more than 20 plugins and uses DMTP for command-and-control and plugin orchestration.
- Tencent addressed CVE-2026-120422 in Sogou Input Method version 16.10, released October 29, 2026, by moving affected requests from HTTP to HTTPS.
- ESET classified SlippyNunchucks as distinct from Mustang Panda, reporting no tactical overlap in its telemetry.
Article Details
- Attack Vectors
- SlippyNunchucks hijacked DNS resolution for Sogou Input Method's branded vocabulary configuration request. Because the request used HTTP, it was routed to a staging server that returned a malicious configuration.
- The configuration directed SGTool.exe to download two payloads from sogou-cdn[.]com and launch the malware via DLL sideloading.
- Separately, Gen Digital reported that UNC3569 exploited CVE-2026-51990 through a crafted link, chaining weaknesses in the sgbiz: protocol handler and a CEF-based WebView with an outdated Chromium engine.
- Defensive Notes
- Tencent addressed CVE-2026-120422 in Sogou Input Method version 16.10, released October 29, 2026, by migrating the affected HTTP requests to HTTPS.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | sogou-cdn[.]com | Domain from which the malicious Sogou configuration instructed SGTool.exe to download two payloads. |
MITRE ATT&CK
T1105 · Ingress Tool TransferSGTool.exe was instructed by the malicious configuration to download two additional payloads from sogou-cdn[.]com.T1204.001 · Malicious LinkGen Digital reported that UNC3569 used a crafted link in a one-click exploit chain involving Sogou Input Method.T1565.002 · Transmitted Data ManipulationDNS resolution was tampered with so the Sogou configuration request reached a staging server that returned a malicious configuration.T1574.002 · DLL Side-LoadingThe downloaded malware was launched via DLL sideloading using SGTool.exe, a legitimate Sogou Input Method component.
CVE
CVE-2021-38003Google · Chromein a CEF-based WebView, and a severely outdated, unsandboxed Chromium browser engine [susceptible to CVE-2021-38003]," Gen Digital said.CVE-2026-120422Sogou · Sogou Input MethodFollowing responsible disclosure, Tencent addressed the vulnerability (CVE-2026-120422) in version 16.10, released on October 29, 2026, by migrating the affected HTTP requests to HTTPS.CVE-2026-51990Vendor / Product unavailableIn September 2026, Gen Digital said a now-patched vulnerability in the input method editor (CVE-2026-51990) was exploited by UNC3569 to deliver a backdoor dubbed GRAYRABBIT by means of a crafted link.
People
Threat Actors
SlippyNunchucksESET attributed the DNS hijacking operation and related DarkVigil deployments to this China-aligned threat actor; ESET described the activity as a nation-state surveillance effort.UNC3569Gen Digital reported that UNC3569 exploited CVE-2026-51990 in Sogou Input Method using a crafted link to deliver a backdoor.
Malware
DarkVigilversions of Sogou Input Method as part of a surveillance campaign designed to deploy an implant called DarkVigil (aka FDMTP).FDMTPSogou Input Method as part of a surveillance campaign designed to deploy an implant called DarkVigil (aka FDMTP).GRAYRABBITin the input method editor (CVE-2026-51990) was exploited by UNC3569 to deliver a backdoor dubbed GRAYRABBIT by means of a crafted link.
Vendors
Products
MiYunChatSome of the applications abused by the adversary include Sogou Input Method, QuickFox, QingTalk, MiYunChat, SoftCam, and tawk.to.QingTalkSome of the applications abused by the adversary include Sogou Input Method, QuickFox, QingTalk, MiYunChat, SoftCam, and tawk.to.QuickFoxSome of the applications abused by the adversary include Sogou Input Method, QuickFox, QingTalk, MiYunChat, SoftCam, and tawk.to.SoftCamSome of the applications abused by the adversary include Sogou Input Method, QuickFox, QingTalk, MiYunChat, SoftCam, and tawk.to.Tencent Sogou Input MethodName System (DNS) hijacking operation abusing insecure HTTP communications in Windows versions of Sogou Input Method as part of a surveillance campaign designed to deploy an implant called DarkVigil (aka FDMTP).
Countries
Hong KongThe campaign, observed starting July 1, 2026, is assessed to have targeted organizations and Chinese-speaking individuals in Hong Kong, Thailand, Japan, Vietnam, Oman, and Sri Lanka, according to ESET.JapanThe campaign, observed starting July 1, 2026, is assessed to have targeted organizations and Chinese-speaking individuals in Hong Kong, Thailand, Japan, Vietnam, Oman, and Sri Lanka, according to ESET.OmanThe campaign, observed starting July 1, 2026, is assessed to have targeted organizations and Chinese-speaking individuals in Hong Kong, Thailand, Japan, Vietnam, Oman, and Sri Lanka, according to ESET.Philippinesan organization operating Chinese-language online betting platforms in Sri Lanka, Hong Kong, and the Philippines," ESET said.Sri LankaThe campaign, observed starting July 1, 2026, is assessed to have targeted organizations and Chinese-speaking individuals in Hong Kong, Thailand, Japan, Vietnam, Oman, and Sri Lanka, according to ESET.ThailandThe campaign, observed starting July 1, 2026, is assessed to have targeted organizations and Chinese-speaking individuals in Hong Kong, Thailand, Japan, Vietnam, Oman, and Sri Lanka, according to ESET.VietnamThe campaign, observed starting July 1, 2026, is assessed to have targeted organizations and Chinese-speaking individuals in Hong Kong, Thailand, Japan, Vietnam, Oman, and Sri Lanka, according to ESET.