SlippyNunchucks Hijacked Sogou Input Method's Plain-HTTP Config Requests to Plant the DarkVigil Backdoor Across Asia — CVE-2026-120422 Fixed in Version 16.10

High · 2026-11-05 · By H.A

SlippyNunchucks Hijacked Sogou Input Method's Plain-HTTP Config Requests to Plant the DarkVigil Backdoor Across Asia — CVE-2026-120422 Fixed in Version 16.10

A China-aligned espionage group tampered with DNS so that Sogou's own SGTool.exe fetched a malicious config and sideloaded the modular DarkVigil (FDMTP) implant, a hole Tencent closed by moving to HTTPS in Sogou Input Method 16.10.

Overview

Security researchers have disclosed a China-aligned espionage group, tracked as SlippyNunchucks, that took over the update and configuration traffic of the Windows version of Sogou Input Method to install a modular backdoor called DarkVigil (also known as FDMTP). Sogou is one of the most widely used Chinese-language keyboards and is owned by Tencent. The flaw that made this possible is now tracked as CVE-2026-120422: some of the app's requests were sent over plain HTTP. Tencent fixed it in Sogou Input Method 16.10, released on 29 October 2026, by moving those requests to HTTPS. One report also says certificate pinning was enabled.

The campaign has been observed since 1 July 2026. It targeted organisations and Chinese-speaking individuals in Hong Kong, Thailand, Japan, Vietnam, Oman and Sri Lanka.

The Campaign

The attack works without a phishing email or user click. A legitimate Sogou component fetches configuration from the network, and the attacker answers that request instead of Sogou:

  1. DNS resolution for config.pinyin.sogou[.]com is tampered with so that the victim reaches an attacker staging server.
  2. SGTool.exe, Sogou's legitimate task dispatcher, requests /api/brandScd/getBrandScd.php over HTTP and gets back a malicious configuration.
  3. The configuration tells the binary to download two files from sogou-cdn[.]com: biz_helper.exe, a legitimate signed Adobe executable, and libcef.dll, a rogue DLL.
  4. biz_helper.exe sideloads libcef.dll, which loads DarkVigil.

DarkVigil is a .NET framework with more than 20 plugins. It talks to its controller over the Duplex Message Transport Protocol (DMTP) and receives plugins for persistence and data collection.

Researchers have not established where the DNS hijacking happens. Compromised routers with altered DNS settings and interception at the ISP level are both possible.

Timeline

Tradecraft

A separate Sogou flaw, CVE-2026-51990, was exploited in September 2026 by a different actor, UNC3569, to deliver the GRAYRABBIT backdoor. That chain abused the sgbiz: protocol handler and an outdated embedded Chromium engine. It shows that this input method is a target for more than one group.

Indicators of Compromise

Detection

# Defensive: find biz_helper.exe / libcef.dll pairs outside Program Files
Get-ChildItem -Path C:\Users,C:\ProgramData -Recurse -Include biz_helper.exe,libcef.dll -ErrorAction SilentlyContinue |
  Select-Object FullName, LastWriteTime

Recommended Actions

Analyst Assessment

This is a well-tested approach. When one trusted application is cleaned up, the group moves to the next one, and plain-HTTP update channels in consumer software remain an easy way in. Organisations with Chinese-speaking staff, regional offices in East and Southeast Asia, or business in the gambling sector should treat this as relevant to them. With the patch available, the main risk now is unmanaged endpoints that never receive it. We rate the threat High.

REEF SENTINEL