China-Aligned Hackers Hijack Sogou Input Method DNS Requests to Deploy DarkVigil Backdoor Ravie LakshmananNov 04, 2026Vulnerability / Malware A China-aligned threat actor known as SlippyNunchucks has been attributed to a Domain Name System (DNS) hijacking operation abusing insecure HTTP communications in Windows versions of Sogou Input Method as part of a surveillance campaign designed to deploy an implant called DarkVigil (aka FDMTP). The campaign, observed starting July 1, 2026, is assessed to have targeted organizations and Chinese-speaking individuals in Hong Kong, Thailand, Japan, Vietnam, Oman, and Sri Lanka, according to ESET. "DarkVigil implants are typically deployed through popular Chinese applications," ESET researcher Anh Ho said in a report shared with The Hacker News. "By abusing these applications, the SlippyNunchucks threat actor has been able to reach Chinese-speaking users across Asia and Europe." Some of the applications abused by the adversary include Sogou Input Method, QuickFox, QingTalk, MiYunChat, SoftCam, and tawk.to. Active since at least September 15, 2023, SlippyNunchucks is known for targeting organizations and Chinese-speaking individuals across South and East Asia. These attacks lead to the deployment of a modular .NET framework that includes DarkVigil and a set of over 20 plugins. Although the use of the backdoor has been previously linked to Mustang Panda, ESET said it found no tactical overlaps between the threat actor and DarkVigil-related activity in its telemetry, prompting it to classify it as a distinct intrusion set. Earlier this August, Fortinet's FortiGuard Incident Response Team detailed the threat actor's supply chain compromise of the QuickFox VPN and network acceleration tool to deliver DarkVigil. According to the Slovakian cybersecurity company, the adversary shifted to exploiting Sogou Input Method, a popular Chinese-language input method editor developed by Tencent, as a delivery vector three days after QuickFox released a clean version of its program. Specifically, the attack involves hijacking the app's branded vocabulary promotion mechanism to serve a malicious configuration, which ultimately paves the way for the deployment of the malware via SGTool.exe, a legitimate Sogou Input Method component that functions as a multi-purpose task dispatcher. In a clean environment, the executable sends an HTTP request to the "config.pinyin.sogou[.]com/api/brandScd/getBrandScd.php" endpoint to fetch a configuration. But in the attack discovered by ESET, the DNS resolution of the domain is tampered with to resolve it to one of the two staging servers - The consequence of this DNS hijacking was that HTTP requests to the "getBrandScd.php" endpoint were routed to one of the staging servers, which then responded with a malicious configuration. The configuration, for its part, instructs the binary to download two additional payloads from "sogou-cdn[.]com" and launch the malware via DLL sideloading - A legitimate Adobe executable ("biz_helper.exe") A rogue DLL ("libcef.dll") containing DarkVigil DarkVigil is notable for its use of Duplex Message Transport Protocol (DMTP) for command-and-control (C2), allowing the client to execute and orchestrate plugins received from an attacker-controlled server to facilitate persistence or data collection. Following responsible disclosure, Tencent addressed the vulnerability (CVE-2026-120422) in version 16.10, released on October 29, 2026, by migrating the affected HTTP requests to HTTPS. SlippyNunchucks is suspected to operate keeping the interests of the Chinese government in mind, with ESET describing it as a nation-state surveillance effort. "Although SlippyNunchucks targets organizations and individuals across multiple sectors, we discovered significant surveillance activity against an organization operating Chinese-language online betting platforms in Sri Lanka, Hong Kong, and the Philippines," ESET said. "The targeting of this organization is notable given China's restrictions on gambling, including criminal penalties for operating gambling businesses and organizing Chinese citizens to gamble abroad." This is not the first time China-nexus threat actors have weaponized the Sogou Input Method as an entry point for malware distribution. In September 2026, Gen Digital said a now-patched vulnerability in the input method editor (CVE-2026-51990) was exploited by UNC3569 to deliver a backdoor dubbed GRAYRABBIT by means of a crafted link. "The vulnerability chains three separate weaknesses into a single, one-click exploit: unvalidated command-line argument injection in the sgbiz: custom protocol handler, unrestricted URL navigation in a CEF-based WebView, and a severely outdated, unsandboxed Chromium browser engine [susceptible to CVE-2021-38003]," Gen Digital said. Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. cyber espionage, Malware, Nation-State, Supply Chain, Vulnerability Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated Network Linux Kernel TCP Flaw With 9.8 CVSS Score Affects Ubuntu, Red Hat and Other Distributions Critical 16-Year-Old UEFI Flaw Can Run Code Before Secure Boot on Network-Booting Servers PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline CyberStrikeAI Uses 44 AI Agents to Automate Hacking Operations Against Japan Targets Attackers Exploit PHP2Shell Flaws in Internet-Exposed Palo Alto Networks Management Interfaces ThreatsDay: Critical Firewall Flaws, Banking Trojans Rented, Weaponized PDF, Token Theft + 26 More Stories GoAhead TLS Flaws Allow Revoked Client Certificates and Enable Session Decryption Cisco Patches Actively Exploited ASA and FTD VPN Flaw That Can Crash Firewalls The Rise of the Threat Operator: How AI Will Redefine Security Operations and Careers Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers Microsoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokens American Organizations Under Attack: Skyw4lker Device Code Phishing Campaign Exposed Chinese Hackers Use AI-Powered ARTEX to Target Over 200 Organizations Worldwide AI-Generated Fake Login Pages Are Making Account Takeovers Easier Anthropic's Unreleased AI Model Chains Flaws Into Working Chrome, Safari, Windows and Linux Exploits China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility Binance Suffers Security Breach Affecting $6.3 Billion in Assets, Nearly $3 Billion Frozen Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations Why Urgent Security Fixes Aren't Fixed. Observe, Prove, Act, Confirm Gets Them Moving TeamViewer Flaw Lets Remote Computers Attack Users Who Connect to Control Them Assess Your Organization's AI Code Sprawl Exposure With This Practical Guide Beyond CVE Scanning: Book a Demo of Continuous AI-Powered Web Pentesting Detect Lateral Movement and Evasive Attacks With Corelight's Open NDR Platform See How Bitdefender GravityZone Identifies Shadow AI and Prioritizes Endpoint Risks Your SOC Has an Identity Blind Spot. Here's How to Fix It Learn how to close critical identity visibility gaps in your SOC, detect hidden threats, and accelerate incident response across human, machine, and AI identities. Reserve My Spot Roadmap for AI-Ready Security Operations Evaluate Attack Surface Visibility With an AI Threat Readiness Framework Learn how to assess AI threat readiness, strengthen attack surface visibility, and prepare security operations for emerging threats in this practical webinar. The 2026 Identity Crisis: Why Your IAM is Only Half the Story Stop driving blind. See the identity blind spots traditional IAM misses. Watch now. 11 Real Stories: How Identity Exposure Unlocks Active Attack Paths Map cross-domain privilege escalation to sever breach routes at key choke points. BeyondTrust an 8X Gartner® Magic Quadrant™ Leader for PAM Gain clarity on the PAM market and understand why BeyondTrust is again a Leader. Governance Sets the Ceiling on Your AI Security Program See the five moves that raise a Stage 2 Govern score to a defensible Stage 3. Your Attack Surface Is Growing Faster Than Your Team Can Respond PEDM vs. Standing Elevated Privileges: Control Access Without Flooding the Helpdesk The MSP Margin Math Nobody's Doing: Your Next Technician Might Already be on Payroll Why Root and Jailbreak Detection Alone Cannot Guarantee Mobile App Security