A hacking campaign tied to a China-aligned actor known as SlippyNunchucks has been identified using DNS hijacking to push a backdoor called DarkVigil (also known as FDMTP). The threat actor manipulated insecure HTTP traffic inside the Windows version of the Sogou Input Method to deliver malicious payloads. The activity was uncovered in cybersecurity investigations spanning several countries in Asia.
How the Attack Works
The intrusion begins when Sogou Input Method—a widely-used Chinese-language input tool developed by Tencent—tries to fetch its branded vocabulary configuration from its usual endpoint: config.pinyin.sogou[.]com/api/brandScd/getBrandScd.php over HTTP. SlippyNunchucks hijacks the DNS resolution of that domain, redirecting it to attacker-controlled servers. The hijacked requests then deliver a malicious configuration. Consequently, the legitimate component SGTool.exe downloads two payloads: a sanctioned Adobe executable (named biz_helper.exe) and a malicious DLL (libcef.dll) that contains the DarkVigil backdoor, which is loaded via DLL sideloading.
Targets, Timeline, and Attribution
ESET first noticed this operation beginning July 1, 2026, targeting organizations and Chinese-speaking individuals in Hong Kong, Thailand, Japan, Vietnam, Oman, and Sri Lanka. The campaign aligns with surveillance objectives often associated with state-aligned operations. SlippyNunchucks has been observed previously using Chinese applications like QuickFox, QingTalk, MiYunChat, SoftCam, and tawk.to to distribute DarkVigil—deploying it through a modular .NET framework with over 20 plugins. Though DarkVigil has been discussed in reports tied to Mustang Panda, ESET found insufficient overlap to attribute it directly to that group.
Patches and Previous Misuse
In response, Tencent issued a fix on October 29, 2026, shifting the vulnerable HTTP request to HTTPS under CVE-2026-120422. This came after SlippyNunchucks had already redirected traffic three days after a clean build of QuickFox was released, exploiting that supply chain as well. The path via Sogou’s “brandScd” mechanism was modified accordingly.
This isn’t the first time Sogou Input Method has been used in similar attacks. In September 2026, a vulnerability in Sogou (CVE-2026-51990) was leveraged by the UNC3569 actor to deliver a backdoor named GRAYRABBIT via crafted exploit chains involving protocol handler injection, WebView URL navigation, and outdated Chromium components. That vulnerability was later patched by Gen Digital.
Why This Matters
The DarkVigil campaign demonstrates how attackers are abusing trusted, popular Chinese software as Trojan horses—especially those with insecure HTTP endpoints. DNS hijacking plus DLL sideloading create a stealthy pathway for modular malware to enter systems that otherwise appear benign. Affected victims include linguistic or regional minorities, showing that surveillance operations still expand under the radar using localization tactics.
Analysis: This incident spotlights an increasingly common strategy in cyber espionage: using legitimate applications as concealment for nation-state malware. The shifting from HTTP to HTTPS patches one vulnerability, but the broader risk remains wherever insecure transport, outdated components, or DNS infrastructure gaps exist. Organizations using software like Sogou Input Method—or any tool that performs remote configuration over HTTP—should review their network configurations, enforce HTTPS wherever possible, and monitor for unexpected DNS resolutions. As attacks like this proliferate, detection of DLL sideloading, staged payload delivery, and plugin architectures will become critical indicators of compromise to watch.
