SlippyNunchucks Hijacked Sogou Input Method's Plain-HTTP Config Requests to Plant the DarkVigil Backdoor Across Asia — CVE-2026-120422 Fixed in Version 16.10

High · 2026-11-05 · By H.A

A China-aligned espionage group tampered with DNS so that Sogou's own SGTool.exe fetched a malicious config and sideloaded the modular DarkVigil (FDMTP) implant, a hole Tencent closed by moving to HTTPS in Sogou Input Method 16.10.

Overview

Security researchers have disclosed a China-aligned espionage group, tracked as SlippyNunchucks, that took over the update and configuration traffic of the Windows version of Sogou Input Method to install a modular backdoor called DarkVigil (also known as FDMTP). Sogou is one of the most widely used Chinese-language keyboards and is owned by Tencent. The flaw that made this possible is now tracked as CVE-2026-120422: some of the app's requests were sent over plain HTTP. Tencent fixed it in Sogou Input Method 16.10, released on 29 October 2026, by moving those requests to HTTPS. One report also says certificate pinning was enabled.

The campaign has been observed since 1 July 2026. It targeted organisations and Chinese-speaking individuals in Hong Kong, Thailand, Japan, Vietnam, Oman and Sri Lanka.

The Campaign

The attack works without a phishing email or user click. A legitimate Sogou component fetches configuration from the network, and the attacker answers that request instead of Sogou:

1. DNS resolution for config.pinyin.sogou[.]com is tampered with so that the victim reaches an attacker staging server.
2. SGTool.exe, Sogou's legitimate task dispatcher, requests /api/brandScd/getBrandScd.php over HTTP and gets back a malicious configuration.
3. The configuration tells the binary to download two files from sogou-cdn[.]com: biz_helper.exe, a legitimate signed Adobe executable, and libcef.dll, a rogue DLL.
4. biz_helper.exe sideloads libcef.dll, which loads DarkVigil.

DarkVigil is a .NET framework with more than 20 plugins. It talks to its controller over the Duplex Message Transport Protocol (DMTP) and receives plugins for persistence and data collection.

Researchers have not established where the DNS hijacking happens. Compromised routers with altered DNS settings and interception at the ISP level are both possible.

Timeline

• 15 September 2023: Earliest known SlippyNunchucks activity.
• Mid-2026: The same actor compromised the QuickFox VPN tool to distribute DarkVigil, as reported by another vendor's incident responders in August.
• 1 July 2026: Sogou DNS-hijack activity first observed. According to researchers, the actor moved to Sogou three days after QuickFox shipped a clean version.
• 29 October 2026: Sogou Input Method 16.10 is released with the HTTPS fix (CVE-2026-120422).
• 4 November 2026: Public disclosure.

Tradecraft

• Trusted-application hijacking: DarkVigil has been delivered repeatedly through popular Chinese software, including QuickFox, QingTalk, MiYunChat, SoftCam and the tawk.to chat widget, so it reaches Chinese-speaking users wherever they live.
• Living off signed binaries: The installer is launched by Sogou's own SGTool.exe, and the malicious DLL is loaded by a legitimate Adobe executable.
• Targeting: One victim was an organisation running Chinese-language online betting platforms in Sri Lanka, Hong Kong and the Philippines. That is a familiar target for Chinese state surveillance, because gambling is restricted in mainland China.
• Researchers treat SlippyNunchucks as a separate intrusion set. DarkVigil has previously been linked to Mustang Panda, but no tactical overlap with that group was found.

A separate Sogou flaw, CVE-2026-51990, was exploited in September 2026 by a different actor, UNC3569, to deliver the GRAYRABBIT backdoor. That chain abused the sgbiz: protocol handler and an outdated embedded Chromium engine. It shows that this input method is a target for more than one group.

Indicators of Compromise

• config.pinyin.sogou[.]com resolving to anything other than legitimate Sogou infrastructure
• sogou-cdn[.]com → 47.239.250[.]102
• dev.soft-png-cdn[.]com → 47.237.122[.]175
• HTTP request path: /api/brandScd/getBrandScd.php answered by a non-Sogou host
• biz_helper.exe together with libcef.dll in a non-Adobe directory, especially when written by SGTool.exe

Detection

• In DNS logs, compare resolutions for config.pinyin.sogou[.]com with known Sogou ranges and alert when they differ.
• Hunt in EDR for SGTool.exe spawning a download or process creation of biz_helper.exe.
• Alert on libcef.dll loaded from user-writable folders by a process that is not a known CEF host.

# Defensive: find biz_helper.exe / libcef.dll pairs outside Program Files
Get-ChildItem -Path C:\Users,C:\ProgramData -Recurse -Include biz_helper.exe,libcef.dll -ErrorAction SilentlyContinue |
  Select-Object FullName, LastWriteTime

Recommended Actions

• Upgrade Sogou Input Method on Windows to 16.10 or later everywhere it is installed, including unmanaged or personal machines used for work.
• Where Chinese IMEs are not needed for business, remove them or restrict them through application control.
• Enforce DNS over a trusted resolver, audit home and branch router DNS settings, and block the indicators above.
• If you find indicators, treat the host as compromised by a modular espionage implant: isolate it, collect memory and rebuild it.

Analyst Assessment

This is a well-tested approach. When one trusted application is cleaned up, the group moves to the next one, and plain-HTTP update channels in consumer software remain an easy way in. Organisations with Chinese-speaking staff, regional offices in East and Southeast Asia, or business in the gambling sector should treat this as relevant to them. With the patch available, the main risk now is unmanaged endpoints that never receive it. We rate the threat High.