China-Aligned Hackers Hijack Sogou Input Method DNS to Deploy DarkVigil Backdoor
A China-aligned threat actor, SlippyNunchucks, has been observed hijacking DNS requests for the Sogou Input Method on Windows to deploy the DarkVigil backdoor as part of a surveillance campaign.
A China-aligned threat actor known as SlippyNunchucks has been attributed to a sophisticated Domain Name System (DNS) hijacking operation that abuses insecure HTTP communications within Windows versions of the Sogou Input Method. This campaign, active since at least July 1, 2026, aims to deploy a backdoor implant named DarkVigil (also known as FDMTP) and has targeted organizations and Chinese-speaking individuals across Hong Kong, Thailand, Japan, Vietnam, Oman, and Sri Lanka.
ESET researchers noted that DarkVigil implants are frequently deployed through popular Chinese applications, allowing threat actors like SlippyNunchucks to reach a broad audience of Chinese-speaking users across Asia and Europe. Other applications previously abused by the adversary include QuickFox, QingTalk, MiYunChat, SoftCam, and tawk.to. SlippyNunchucks has been active since at least September 15, 2023, and is known for targeting organizations and individuals in South and East Asia, deploying a modular .NET framework that includes DarkVigil and numerous plugins.
While the DarkVigil backdoor has been previously linked to the threat group Mustang Panda, ESET found no tactical overlaps in its telemetry, leading them to classify SlippyNunchucks as a distinct intrusion set. This follows a similar supply chain compromise detailed earlier by Fortinet, where the threat actor used the QuickFox VPN and network acceleration tool to deliver DarkVigil.
The attack chain specifically targets the Sogou Input Method's branded vocabulary promotion mechanism. Adversaries hijack this feature to serve a malicious configuration, ultimately enabling the deployment of malware via SGTool.exe, a legitimate Sogou component. In a normal scenario, SGTool.exe fetches a configuration from a legitimate endpoint. However, in this attack, the DNS resolution for this domain is manipulated to redirect the request to one of two staging servers controlled by the attackers.
This DNS hijacking redirects HTTP requests to the legitimate configuration endpoint to a malicious staging server. This server then responds with a malicious configuration that instructs SGTool.exe to download two additional payloads from a compromised domain. These payloads include a legitimate Adobe executable, 'biz_helper.exe,' and a rogue DLL, 'libcef.dll,' which contains the DarkVigil backdoor. The malware is then loaded into memory via DLL sideloading.
DarkVigil is characterized by its use of the Duplex Message Transport Protocol (DMTP) for command-and-control (C2) communications. This protocol allows the backdoor to execute and orchestrate various plugins received from an attacker-controlled server, facilitating persistence, data exfiltration, and other malicious activities.
Tencent, the developer of Sogou Input Method, has addressed the vulnerability (CVE-2026-120422) in version 16.10, released on October 29, 2026, by migrating the affected HTTP requests to HTTPS. This move is expected to mitigate future exploitation of this specific vector.
SlippyNunchucks is believed to operate in alignment with the interests of the Chinese government, with ESET characterizing its activities as a nation-state surveillance effort. The targeting of an organization operating Chinese-language online betting platforms in Sri Lanka, Hong Kong, and the Philippines is particularly noteworthy, given China's strict regulations and penalties against gambling operations. This incident is not the first time China-nexus threat actors have weaponized the Sogou Input Method; a similar vulnerability was exploited in September 2026 by UNC3569 to deliver the GRAYRABBIT backdoor.