China-aligned SlippyNunchucks hijacks Sogou Input Method (Sogou Pinyin) for Windows config traffic to install the DarkVigil backdoor on Chinese speakers abroad (ESET)

ESET reports that the China-aligned group SlippyNunchucks (active since at least 2023-09-15) has hijacked DNS resolution for config.pinyin.sogou[.]com since 2026-07-01. Sogou Input Method for Windows fetched its brand-vocabulary config (getBrandScd.php) over plain HTTP. The attacker's server returned a malicious config that made the SGTool.exe task dispatcher download a disguised signed Adobe binary and the DarkVigil (FDMTP) .NET backdoor DLL into the Sogou Components folder, where Sogou's own component workflow runs them. DarkVigil has 20+ plugins (e.g. the Pillager stealer) and uses DMTP for C&C. Confirmed victims are Chinese-speaking organisations and individuals in Hong Kong, Thailand, Japan, Vietnam, Oman and Sri Lanka. ESET does not know where the DNS tampering happens (compromised routers or ISP-level interception are possible). Tencent fixed it in Sogou Input Method 16.10 (end of October 2026), which moves the requests to HTTPS with certificate pinning.