SlippyNunchucks Exploits Sogou Input Method DNS Hijack to Deploy DarkVigil Backdoor Across Asia
A China-aligned threat actor tracked as SlippyNunchucks has been conducting a DNS hijacking campaign since July 1, 2026, abusing insecure HTTP communications in the Windows version of Sogou Input Method to deploy the DarkVigil (aka FDMTP) implant. According to ESET researcher Anh Ho, the campaign targeted organizations and Chinese-speaking individuals in Hong Kong, Thailand, Japan, Vietnam, Oman, and Sri Lanka, including an organization operating Chinese-language online betting platforms. The actor has previously abused other popular Chinese applications including QuickFox, QingTalk, MiYunChat, SoftCam, and tawk.to, and shifted to Sogou three days after QuickFox patched its own compromised VPN tool in August 2026. ESET found no tactical overlap with Mustang Panda despite prior links, classifying SlippyNunchucks as a distinct intrusion set active since at least September 2023.
Entenda a falha
A vulnerabilidade
CVE-2026-120422 is an insecure-communication flaw in the Windows version of Sogou Input Method (Tencent). The SGTool.exe component fetches its configuration over plain HTTP from the branded vocabulary promotion endpoint, so an attacker who can tamper with DNS resolution of that domain can serve a malicious configuration and get the client to download and run code. Fixed in version 16.10, released October 29, 2026. The story also cites CVE-2026-51990 (sgbiz: protocol handler, UNC3569, GRAYRABBIT) and CVE-2021-38003 only as a prior, separate campaign.
Como funciona
SGTool.exe, a legitimate Sogou component that works as a multi-purpose task dispatcher, sends an HTTP request to config.pinyin.sogou[.]com/api/brandScd/getBrandScd.php to get a configuration. In the attack, DNS resolution of that domain is tampered with so the request goes to one of two attacker staging servers instead of Tencent infrastructure. The server answers with a malicious configuration, which tells the binary to download a legitimate Adobe executable (biz_helper.exe) and a rogue libcef.dll containing DarkVigil from sogou-cdn[.]com. The Adobe executable then loads the DLL through sideloading, and the implant contacts its C2 over DMTP.
Por que é vulnerável
The client trusted configuration data fetched over unencrypted HTTP, with no transport protection to guarantee the response came from Tencent's servers. Anyone able to control DNS resolution could therefore impersonate the endpoint and dictate what the client downloads and launches. The fix migrates the affected requests to HTTPS.
Onde está
The SGTool.exe component of Sogou Input Method and its request to the /api/brandScd/getBrandScd.php endpoint on config.pinyin.sogou[.]com.
Como foi descoberta
ESET researcher Anh Ho found the flaw while analyzing a DNS hijacking campaign by SlippyNunchucks, observed since July 1, 2026. Following responsible disclosure, Tencent fixed it in version 16.10 on October 29, 2026. ESET's report was shared with The Hacker News on November 4, 2026. The actor had shifted to Sogou three days after QuickFox released a clean version of its tool, which Fortinet's FortiGuard Incident Response Team had detailed in August.
Explicação gerada por IA a partir da matéria e dos artigos, em 04/11/2026 10:16.
Detalhes técnicos
The attack hijacks the DNS resolution of Sogou's branded vocabulary promotion endpoint (config.pinyin.sogou[.]com/api/brandScd/getBrandScd.php), redirecting the legitimate SGTool.exe component to attacker-controlled staging servers at 47.239.250[.]102 (sogou-cdn[.]com) and 47.237.122[.]175 (dev.soft-png-cdn.com) instead of the real Tencent infrastructure. These servers return a malicious configuration instructing the client to download a legitimate Adobe executable (biz_helper.exe) and a rogue DLL (libcef.dll) containing DarkVigil, which is then launched via DLL sideloading. DarkVigil communicates over a custom Duplex Message Transport Protocol (DMTP) for C2, supporting more than 20 modular plugins for persistence and data collection. The underlying flaw was tracked as CVE-2026-120422. The article also notes a related but distinct prior campaign (September 2026) where UNC3569 exploited CVE-2026-51990 in Sogou's sgbiz: protocol handler, chained with an outdated Chromium engine (CVE-2021-38003), to deliver the GRAYRABBIT backdoor via a one-click exploit, as reported by Gen Digital.
Remediação
Tencent addressed CVE-2026-120422 in Sogou Input Method version 16.10, released October 29, 2026, by migrating the affected HTTP requests to HTTPS. Organizations using Sogou Input Method on Windows should update immediately and monitor for DNS anomalies and unauthorized DLL sideloading involving signed executables like Adobe's biz_helper.exe.
Linha do tempo
-
SlippyNunchucks Exploits Sogou Input Method DNS Hijack to Deploy DarkVigil Backdoor Across Asia
ler a análise desta fonte ocultar
A China-aligned threat actor tracked as SlippyNunchucks has been conducting a DNS hijacking campaign since July 1, 2026, abusing insecure HTTP communications in the Windows version of Sogou Input Method to deploy the DarkVigil (aka FDMTP) implant. According to ESET researcher Anh Ho, the campaign targeted organizations and Chinese-speaking individuals in Hong Kong, Thailand, Japan, Vietnam, Oman, and Sri Lanka, including an organization operating Chinese-language online betting platforms. The actor has previously abused other popular Chinese applications including QuickFox, QingTalk, MiYunChat, SoftCam, and tawk.to, and shifted to Sogou three days after QuickFox patched its own compromised VPN tool in August 2026. ESET found no tactical overlap with Mustang Panda despite prior links, classifying SlippyNunchucks as a distinct intrusion set active since at least September 2023.
Technical Details
The attack hijacks the DNS resolution of Sogou's branded vocabulary promotion endpoint (
config.pinyin.sogou[.]com/api/brandScd/getBrandScd.php), redirecting the legitimateSGTool.execomponent to attacker-controlled staging servers at 47.239.250[.]102 (sogou-cdn[.]com) and 47.237.122[.]175 (dev.soft-png-cdn.com) instead of the real Tencent infrastructure. These servers return a malicious configuration instructing the client to download a legitimate Adobe executable (biz_helper.exe) and a rogue DLL (libcef.dll) containing DarkVigil, which is then launched via DLL sideloading. DarkVigil communicates over a custom Duplex Message Transport Protocol (DMTP) for C2, supporting more than 20 modular plugins for persistence and data collection. The underlying flaw was tracked as CVE-2026-120422. The article also notes a related but distinct prior campaign (September 2026) where UNC3569 exploited CVE-2026-51990 in Sogou'ssgbiz:protocol handler, chained with an outdated Chromium engine (CVE-2021-38003), to deliver the GRAYRABBIT backdoor via a one-click exploit, as reported by Gen Digital.Remediation
Tencent addressed CVE-2026-120422 in Sogou Input Method version 16.10, released October 29, 2026, by migrating the affected HTTP requests to HTTPS. Organizations using Sogou Input Method on Windows should update immediately and monitor for DNS anomalies and unauthorized DLL sideloading involving signed executables like Adobe's
biz_helper.exe.