EN PT-BR
← Voltar ao feed
high gambling other telecommunications education

SlippyNunchucks hijacks DNS to abuse Sogou Input Method and deploy DarkVigil (FDMTP) backdoor across Asia; fixed in version 16.10

2 fonte(s) · 2 atualização(ões) · publicado 04/11/2026 08:24 · coletado há 13 horas

Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 2 fontes trouxeram em 05/11/2026 00:02; os links antigos trazem para cá.

Fontes: infosecurity-magazine.com ↗ thehackernews.com ↗

A China-aligned threat actor tracked by ESET as SlippyNunchucks has run a DNS hijacking campaign against the Windows version of Sogou Input Method (owned by Tencent) to deliver the DarkVigil (aka FDMTP) implant. ESET researcher Anh Ho disclosed it, and the campaign has run since July 1, 2026 (thehackernews.com). A Sogou component fetched its brand-promotion configuration over plaintext HTTP. Redirected requests returned a malicious configuration that made the app download and run DarkVigil under Sogou's own trusted process, which gave persistence without a separate mechanism (infosecurity-magazine.com). Victims were in Hong Kong, Thailand, Japan, Vietnam, Oman and Sri Lanka. They included a multinational gambling organization operating Chinese-language betting platforms, a Dubai internet café and a Denmark-based university student (thehackernews.com, infosecurity-magazine.com). ESET assesses with high confidence that the group serves Chinese state-aligned surveillance interests and has tracked it since at least September 2023. Tencent fixed the flaw (CVE-2026-120422) in Sogou Input Method 16.10, released in late October 2026 (October 29 per thehackernews.com).

Entenda a falha

A vulnerabilidade

CVE-2026-120422 is an insecure-communication flaw in the Windows version of Sogou Input Method (Tencent). The SGTool.exe component fetches its brand-promotion configuration over plain HTTP. An attacker who can tamper with DNS resolution of that domain (the network position is unknown) can serve a malicious configuration and make the client download and run code under Sogou's trusted process. No authentication or user interaction is described. Fixed in version 16.10, released in late October 2026 (October 29 per The Hacker News). CVE-2026-51990 and CVE-2021-38003 appear only as a separate, earlier campaign.

Como funciona

SGTool.exe, a legitimate Sogou component that works as a multi-purpose task dispatcher, sends an HTTP request to the getBrandScd.php endpoint on config.pinyin.sogou[.]com to get its configuration. In the attack, DNS resolution of that domain is tampered with so the request reaches an attacker staging server instead of Tencent. The server replies with a malicious configuration, which tells the binary to download a legitimate Adobe executable (biz_helper.exe) and a rogue libcef.dll containing DarkVigil from sogou-cdn[.]com. The Adobe executable loads the DLL by sideloading. Because it runs under Sogou's own components, the malware gets persistence without a separate mechanism. The implant then talks to its C2 over DMTP.

Por que é vulnerável

The client trusted configuration data fetched over unencrypted HTTP, with no transport protection proving the response came from Tencent's servers. Anyone controlling DNS resolution could impersonate the endpoint and dictate what the client downloads and launches. Version 16.10 moves the affected requests to HTTPS and, per Infosecurity Magazine, enables certificate pinning. ESET notes that the downloader still does not validate downloaded file types or restrict where files are saved, so some risk remains.

Onde está

The SGTool.exe component of Sogou Input Method and its request to the /api/brandScd/getBrandScd.php endpoint on config.pinyin.sogou[.]com.

Como foi descoberta

ESET researcher Anh Ho detailed the campaign in a report published on November 4, 2026. The articles say the activity began on July 1, 2026, and that the number and spread of victims first made ESET suspect an exploit. ESET reported the issue to Tencent on September 11 and Tencent acknowledged it on September 21. Tencent fixed it in version 16.10 in late October. The Hacker News says the actor moved to Sogou three days after QuickFox released a clean version in August, which does not fit a July start; the articles do not resolve this, so the start date is uncertain. ESET does not know where the DNS manipulation took place.

PoC existente, privada

O exploit existe, mas quem o tem não o publicou.

No article mentions a published proof of concept. The flaw was exploited in the wild by SlippyNunchucks to deliver DarkVigil, a working and operational attack chain, but no copy of the exploit or tooling is public. Since exploitation is active and the fix is out, updating to 16.10 is urgent.

Explicação gerada por IA a partir da matéria e dos artigos, em 05/11/2026 00:18.

Detalhes técnicos

  • The abused endpoint is Sogou's branded vocabulary promotion API (config.pinyin.sogou[.]com/api/brandScd/getBrandScd.php). DNS hijacking redirected the legitimate SGTool.exe component to attacker staging servers 47.239.250[.]102 (sogou-cdn[.]com) and 47.237.122[.]175 (dev.soft-png-cdn.com) instead of Tencent infrastructure (thehackernews.com).
  • The servers returned a malicious configuration telling the client to download a legitimate Adobe executable (biz_helper.exe) and a rogue libcef.dll containing DarkVigil, which is launched via DLL sideloading (thehackernews.com).
  • DarkVigil/FDMTP is a modular .NET toolset with more than 20 plugins for persistence and data collection. It uses a custom Duplex Message Transport Protocol (DMTP) for C2 (thehackernews.com, infosecurity-magazine.com).
  • ESET does not know where the DNS manipulation occurred. Possibilities include router misconfiguration, router implants or ISP-level interception (infosecurity-magazine.com).
  • Before this campaign, the group's only known distribution method was the supply-chain compromise of QuickFox (infosecurity-magazine.com). It has also abused QingTalk, MiYunChat, SoftCam and tawk.to (thehackernews.com).
  • ESET ties the gambling-sector targeting to China's gambling restrictions and to China-aligned groups' apparent support for law enforcement action against Chinese nationals linked to regional fraud (infosecurity-magazine.com).
  • A related but distinct earlier campaign (September 2026) saw UNC3569 exploit CVE-2026-51990 in Sogou's sgbiz: protocol handler. It chained that with an outdated Chromium engine (CVE-2021-38003) to deliver the GRAYRABBIT backdoor via a one-click exploit, as reported by Gen Digital (thehackernews.com).
  • Darktrace previously linked FDMTP to Mustang Panda with moderate confidence. ESET's telemetry showed no tactical overlap and tracks SlippyNunchucks as a distinct intrusion set (thehackernews.com, infosecurity-magazine.com).

Remediação

  • Update Sogou Input Method on Windows to version 16.10 or later. It moved the affected requests to HTTPS and enabled certificate pinning (infosecurity-magazine.com, thehackernews.com).
  • ESET reported the issue to Tencent on September 11, 2026, and Tencent acknowledged it on September 21 (infosecurity-magazine.com).
  • Residual risk remains: the downloader component still does not validate downloaded file types or restrict save locations (infosecurity-magazine.com).
  • Monitor for DNS anomalies and unauthorized DLL sideloading involving signed executables such as Adobe's biz_helper.exe (thehackernews.com).

Relatos divergentes

  • Timeline of the Sogou shift: thehackernews.com dates the campaign to July 1, 2026. It also says the actor moved to Sogou three days after QuickFox patched its compromised VPN tool in August 2026, which does not fit a July start. The sources do not resolve this, so treat the exact start date as uncertain.
  • Victim geography: both sources list six countries, but infosecurity-magazine.com also names a Dubai internet café and a Denmark-based student. Neither location is in the six-country list, so the full victim footprint may be wider than stated.
  • Release date and hardening of 16.10: thehackernews.com gives October 29, 2026 and mentions only the move to HTTPS. infosecurity-magazine.com says "late October" and adds certificate pinning. The latter is more detailed on the fix.
  • Attribution to Mustang Panda: Darktrace's earlier moderate-confidence link is contradicted by ESET's later telemetry, which found no overlap.

Linha do tempo

  1. infosecurity-magazine.com ↗ · pub. 04/11/2026 12:00 · coletado 04/11 12:01

    China-Aligned SlippyNunchucks Hijacks Sogou Input Method Updates to Deploy DarkVigil Malware

    ler a análise desta fonte

    ESET researcher Anh Ho disclosed a campaign by a China-aligned group tracked as SlippyNunchucks, which abused the brand-promotion mechanism of Sogou Input Method (owned by Tencent) to deliver the DarkVigil (aka FDMTP) implant. The group used DNS hijacking to redirect an unencrypted HTTP request made by a Sogou component to attacker-controlled servers, which returned a malicious configuration causing the app to download and execute DarkVigil under Sogou's own trusted process, achieving persistence without a separate mechanism. ESET traces SlippyNunchucks activity back to at least September 15, 2023, and assesses with high confidence that the group is tied to Chinese state-aligned surveillance interests. Victims spanning six countries (Hong Kong, Thailand, Japan, Vietnam, Sri Lanka, and Oman) included a multinational gambling organization, a Dubai internet café, and a Denmark-based university student.

    Technical Details

    The Sogou component fetched its brand-promotion configuration over plaintext HTTP; DNS hijacking rerouted this request to attacker infrastructure. ESET does not know where the DNS manipulation occurred, citing possible router misconfiguration, router implants, or ISP-level interception. DarkVigil/FDMTP is a modular .NET toolset with more than 20 plugins. While Darktrace previously linked FDMTP to Mustang Panda with moderate confidence, ESET's telemetry showed no overlap and tracks SlippyNunchucks as a distinct cluster. Prior to this campaign, the group's only known distribution method was a supply-chain compromise of QuickFox. ESET links the gambling-sector targeting to China's gambling restrictions and to China-aligned groups' apparent support for law enforcement actions against Chinese nationals tied to regional fraud.

    Remediation

    ESET reported the issue to Tencent on September 11, 2026; Tencent acknowledged it September 21. Sogou Input Method version 16.10 (late October) moved the affected requests to HTTPS and enabled certificate pinning, closing the abused unencrypted channel. ESET notes the downloader component still does not validate downloaded file types or restrict save locations, leaving residual risk.

  2. thehackernews.com ↗ · pub. 04/11/2026 08:24 · coletado 04/11 10:00 primeiro registro

    SlippyNunchucks Exploits Sogou Input Method DNS Hijack to Deploy DarkVigil Backdoor Across Asia

    ler a análise desta fonte

    A China-aligned threat actor tracked as SlippyNunchucks has been conducting a DNS hijacking campaign since July 1, 2026, abusing insecure HTTP communications in the Windows version of Sogou Input Method to deploy the DarkVigil (aka FDMTP) implant. According to ESET researcher Anh Ho, the campaign targeted organizations and Chinese-speaking individuals in Hong Kong, Thailand, Japan, Vietnam, Oman, and Sri Lanka, including an organization operating Chinese-language online betting platforms. The actor has previously abused other popular Chinese applications including QuickFox, QingTalk, MiYunChat, SoftCam, and tawk.to, and shifted to Sogou three days after QuickFox patched its own compromised VPN tool in August 2026. ESET found no tactical overlap with Mustang Panda despite prior links, classifying SlippyNunchucks as a distinct intrusion set active since at least September 2023.

    Technical Details

    The attack hijacks the DNS resolution of Sogou's branded vocabulary promotion endpoint (config.pinyin.sogou[.]com/api/brandScd/getBrandScd.php), redirecting the legitimate SGTool.exe component to attacker-controlled staging servers at 47.239.250[.]102 (sogou-cdn[.]com) and 47.237.122[.]175 (dev.soft-png-cdn.com) instead of the real Tencent infrastructure. These servers return a malicious configuration instructing the client to download a legitimate Adobe executable (biz_helper.exe) and a rogue DLL (libcef.dll) containing DarkVigil, which is then launched via DLL sideloading. DarkVigil communicates over a custom Duplex Message Transport Protocol (DMTP) for C2, supporting more than 20 modular plugins for persistence and data collection. The underlying flaw was tracked as CVE-2026-120422. The article also notes a related but distinct prior campaign (September 2026) where UNC3569 exploited CVE-2026-51990 in Sogou's sgbiz: protocol handler, chained with an outdated Chromium engine (CVE-2021-38003), to deliver the GRAYRABBIT backdoor via a one-click exploit, as reported by Gen Digital.

    Remediation

    Tencent addressed CVE-2026-120422 in Sogou Input Method version 16.10, released October 29, 2026, by migrating the affected HTTP requests to HTTPS. Organizations using Sogou Input Method on Windows should update immediately and monitor for DNS anomalies and unauthorized DLL sideloading involving signed executables like Adobe's biz_helper.exe.