Sogou Input Method DNS Hijacking Used to Deliver DarkVigil Backdoor

A threat actor known as SlippyNunchucks hijacked DNS requests made by Windows versions of Sogou Input Method to deliver the DarkVigil backdoor, according to ESET. The campaign, which researchers observed from July 1, 2026, was assessed to have targeted organizations and Chinese-speaking individuals in Hong Kong, Thailand, Japan, Vietnam, Oman and Sri Lanka.

The attack took advantage of the app’s vocabulary-promotion feature and its use of HTTP to retrieve configuration data. Under normal conditions, Sogou Input Method’s SGTool.exe component contacts a Sogou endpoint for that configuration. ESET found that manipulated DNS responses instead directed requests to attacker-controlled staging servers, which returned a malicious configuration.

That configuration instructed SGTool.exe to download a legitimate Adobe executable and a malicious DLL. The program then loaded DarkVigil through DLL sideloading. DarkVigil uses the Duplex Message Transport Protocol for command and control, enabling it to run plugins supplied by an attacker-controlled server for activities including persistence and data collection.

ESET said SlippyNunchucks has been active since at least September 15, 2023, and has abused several popular applications to reach Chinese-speaking users, including QuickFox, QingTalk, MiYunChat, SoftCam and tawk.to. The group’s activity has involved a modular .NET framework containing DarkVigil and more than 20 plugins.

The researchers classified SlippyNunchucks as a distinct intrusion set, noting that their telemetry showed no tactical overlap with Mustang Panda, despite earlier links between that group and DarkVigil. ESET described the campaign as a nation-state surveillance effort and reported significant activity against an organization running Chinese-language online betting platforms in Sri Lanka, Hong Kong and the Philippines.

Tencent addressed the Sogou issue in version 16.10, released on October 29, 2026, by switching the affected requests from HTTP to HTTPS. The vulnerability was assigned CVE-2026-120422.

Sources: The Hacker News.