"DarkVigil implants are typically deployed through popular Chinese applications," ESET researcher Anh Ho said. The observation cuts to the core of a surveillance campaign that, security researchers say, weaponized a widely used Chinese input method to push a modular backdoor to Chinese‑speaking users across Asia and beyond.
SlippyNunchucks and the DarkVigil implant
ESET attributes the campaign to a China‑aligned actor it calls SlippyNunchucks, a set of operations active since at least September 15, 2023. ESET describes the activity as a nation‑state surveillance effort and says it deployed a modular .NET framework that includes the DarkVigil backdoor (also tracked as FDMTP) plus more than 20 plugins. DarkVigil uses a Duplex Message Transport Protocol (DMTP) for command‑and‑control, allowing the client to execute and orchestrate attacker‑delivered plugins to facilitate persistence and data collection.
How the Sogou Input Method was abused
According to ESET, the adversary hijacked the branded vocabulary promotion mechanism of Sogou Input Method — a Chinese‑language input method editor developed by Tencent — by tampering with DNS resolution. In a normal, clean environment the Sogou component SGTool.exe issues an HTTP request to the endpoint config.pinyin.sogou[.]com/api/brandScd/getBrandScd.php to fetch a configuration. In the observed attacks, DNS resolution for that domain was altered so the request routed instead to one of two staging servers:
- 47.239.250[.]102 (sogou-cdn[.]com)
- 47.237.122[.]175 (dev.soft-png-cdn.com)
The staging servers responded with a malicious configuration that instructed SGTool.exe to download two additional payloads from sogou-cdn[.]com and then launch the malware via DLL sideloading: a legitimate Adobe executable named biz_helper.exe and a rogue DLL libcef.dll that contained DarkVigil.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleRelated supply‑chain and application vectors
Fortinet's FortiGuard Incident Response Team reported a related supply‑chain compromise in August that used the QuickFox VPN and network acceleration tool to deliver DarkVigil. ESET said the adversary shifted to exploiting Sogou Input Method three days after QuickFox released a clean version of its program. ESET also listed additional applications SlippyNunchucks has abused, including QuickFox, QingTalk, MiYunChat, SoftCam, and tawk.to — evidence the actor has repeatedly weaponized popular Chinese applications as delivery vectors.
Targets, geography, and motive
ESET observed campaign activity beginning July 1, 2026, and assessed that SlippyNunchucks targeted organizations and Chinese‑speaking individuals in Hong Kong, Thailand, Japan, Vietnam, Oman, and Sri Lanka. While the actor targeted multiple sectors, ESET highlighted "significant surveillance activity against an organization operating Chinese‑language online betting platforms in Sri Lanka, Hong Kong, and the Philippines." ESET noted this focus is notable given China's restrictions on gambling and described the operation as keeping the interests of the Chinese government in mind. ESET also reported it found no tactical overlaps in its telemetry between SlippyNunchucks and previously tracked DarkVigil activity attributed to Mustang Panda, leading ESET to classify SlippyNunchucks as a distinct intrusion set.
What this means for security teams, Chinese‑language betting platforms, and software vendors
Security teams: The campaign demonstrates DNS tampering of application update/branding endpoints, the use of staged hosting IPs, and DLL sideloading through legitimate binaries (SGTool.exe and biz_helper.exe). ESET's findings point to monitoring DNS resolution for unexpected IPs and unusual configuration responses to the Sogou getBrandScd.php endpoint, and watching for DLLs such as libcef.dll loaded alongside legitimate executables.
Chinese‑language betting platforms (affected enterprises): ESET's telemetry found focused surveillance of a Chinese‑language online betting organization with operations in Sri Lanka, Hong Kong, and the Philippines. Those organizations were specifically targeted for surveillance, according to ESET, and should treat this incident as a direct alert to possible nation‑state interest in their systems.
Software vendors (Tencent and other app maintainers): After responsible disclosure, Tencent addressed the vulnerability tracked as CVE‑2026‑120422 by migrating the affected HTTP requests to HTTPS in Sogou Input Method version 16.10, released on October 29, 2026. Fortinet and Gen Digital reporting also show attackers are quick to move between compromised third‑party tools and popular applications; vendors should consider the integrity of branded update mechanisms and third‑party CDN and DNS dependencies.
Separately, Gen Digital reported in September 2026 that UNC3569 exploited a different Sogou Input Method vulnerability (CVE‑2026‑51990) to deliver a backdoor called GRAYRABBIT via a one‑click exploit chain involving the sgbiz: custom protocol handler, an unrestricted URL navigation in a CEF‑based WebView, and an outdated Chromium engine.
Observers now have a clear, specific technical tableau: DNS hijacking of config.pinyin.sogou[.]com, staging IPs resolving sogou‑cdn[.]com and dev.soft‑png‑cdn.com, DLL sideloading that uses biz_helper.exe and libcef.dll, and a DMTP‑based backdoor framework with many plugins. Tencent's migration of the affected requests to HTTPS (CVE‑2026‑120422, fixed in version 16.10) addresses one exploited channel, but the record of toolchain compromises and multiple abused applications leaves open which additional popular applications may need similar fixes — and how quickly threat actors will shift delivery methods in response.
Original reporting: https://thehackernews.com/2026/11/china-aligned-hackers-hijack-sogou.html
