Security researchers have uncovered a cyberespionage campaign that leverages Sogou Input Method—one of China’s most widely used Chinese‐language keyboard tools—to deliver a backdoor malware dubbed DarkVigil. The threat actor, named SlippyNunchucks and linked to Chinese state interests, has been abusing the software without exploiting any code flaws, exploiting instead insecure network requests.
DNS Hijacking as the Entry Vector
Since July 1, 2026, SlippyNunchucks has been using Sogou in Hong Kong, Thailand, Japan, Vietnam, Sri Lanka, and Oman to deliver DarkVigil implants. Rather than exploiting programmatic bugs, the attackers hijacked DNS responses for Sogou’s configuration updates, which are sent over unsecured HTTP. They redirected requests from legitimate servers (within Tencent-owned Sogou) to attacker-controlled ones. As a result, fake configuration files were used to push malicious components. Tencent patched the issue in version 16.10, now identified as CVE-2026-120422.
How DarkVigil Operates
The campaign begins with a Sogou component named SGTool.exe issuing a request for a small config file meant to control a “brand promotion” feature. Under hijacked DNS, this file is replaced to instruct the app to download two items: a legitimate, signed Adobe helper program renamed biz_helper.exe, and the DarkVigil backdoor disguised as libcef.dll. Attackers manipulated checksums so that Sogou’s integrity checks still accept the malicious payloads. The legitimate Adobe helper is renamed SogouComMgr.exe, enabling DLL side-loading. DarkVigil is deployed without needing its own persistence mechanism, and backup files are planted in a biz_center folder in case updates override the main implant.
Reach, Capabilities, and Evidence
According to ESET’s investigations, DarkVigil is a modular .NET toolset with more than 20 plugins. It uses the Duplex Message Transport Protocol to communicate with its command and control infrastructure, allowing remote operators to push plugins that are stored in the Windows registry and executed later. Victims have been found across sectors: a Sri Lankan firm operating Chinese-language betting sites; an internet café in Dubai; a student in Denmark; and entities in Hong Kong and the Philippines. Though some public reports have associated SlippyNunchucks with other threat groups like Mustang Panda, ESET has not confirmed those links.
Mitigation & Indicators of Compromise
Users are advised to update Sogou Input Method to version 16.10 or later immediately. Infected systems often show renamed Adobe helper executables inside Sogou’s Components folder. Security teams should monitor network traffic for connections to identified bootstrap domains such as blog[.]wangmengfun[.]top, update[.]mssproxy[.]net, img[.]fusfun[.]top, as well as certain IPs hosted by Alibaba. Reviewing router DNS configurations is critical, as many infections originate from DNS manipulation at the network or ISP level.
DarkVigil’s emergence adds to a growing pattern of abuses targeting widely distributed apps through trusted update or configuration mechanisms. Earlier campaigns attempted hijacks via update servers or misissued network requests.
Why this matters: hijacking legitimate software like Sogou to deploy espionage tools represents a serious escalation. Software that’s deeply embedded in daily workflows now serves as a stealthy vector for state-level surveillance—especially in contexts where users are less likely to scrutinize background processes. Going forward, defenders must treat every network request, even those from trusted apps, as a potential threat vector. Keep software patched, insist on HTTPS, validate file signatures, and monitor for odd domain activity—before benign tools become backdoors.
