{"id":"CMP-202611-26cfz5","kind":"campaign","aliases":[],"related":[],"title":"China-aligned SlippyNunchucks hijacks Sogou Input Method (Sogou Pinyin) for Windows config traffic to install the DarkVigil backdoor on Chinese speakers abroad (ESET)","description":null,"summary":"ESET reports that the China-aligned group SlippyNunchucks (active since at least 2023-09-15) has hijacked DNS resolution for config.pinyin.sogou[.]com since 2026-07-01. Sogou Input Method for Windows fetched its brand-vocabulary config (getBrandScd.php) over plain HTTP. The attacker's server returned a malicious config that made the SGTool.exe task dispatcher download a disguised signed Adobe binary and the DarkVigil (FDMTP) .NET backdoor DLL into the Sogou Components folder, where Sogou's own component workflow runs them. DarkVigil has 20+ plugins (e.g. the Pillager stealer) and uses DMTP for C&C. Confirmed victims are Chinese-speaking organisations and individuals in Hong Kong, Thailand, Japan, Vietnam, Oman and Sri Lanka. ESET does not know where the DNS tampering happens (compromised routers or ISP-level interception are possible). Tencent fixed it in Sogou Input Method 16.10 (end of October 2026), which moves the requests to HTTPS with certificate pinning.","severity":"high","cvss":null,"epss":null,"exploited":true,"exploited_at":"2026-11-04T10:23:32+00:00","products":[{"name":"Sogou Input Method","fixed":[],"vendor":"Tencent","fixed_in":"16.10","platform":"Windows"}],"ecosystems":[],"tags":["campaign","early-warning"],"not_affected_if":[],"how_to_check":"Windows machines running Sogou Input Method older than 16.10. In the Sogou install, look for \\Components\\SogouComMgr.exe replaced by a different binary, \\Components\\libcef.dll, \\Components\\biz_center\\<version>\\, and the registry value HKCU\\Software\\Microsoft\\IME\\<HWID>\\pluginHash. SHA-1: 8A60A8E90E1F5F08F28FE5A6DD57BD686C20DC23 (libcef.dll, DarkVigil), 3E16BA611782AF6E45576D390488D28FD676BADE (Microsoft.VisualStudio.HostingProcess.Utilities.Sync.dll, DarkVigil), 79188C8DE2378B437D39E867475C5B4714A0D7C9 (biz_helper.exe, abused Adobe binary). Domains: sogou-cdn[.]com, dev.soft-png-cdn[.]com, blog.wangmengfun[.]top, update.mssproxy[.]net, img.fusfun[.]top. IPs: 47.237.122[.]175, 47.239.250[.]102, 47.236.254[.]159, 47.86.15[.]162. Also look for config.pinyin.sogou[.]com resolving to unexpected IPs. ESET detections: Win64/Agent.KSV, MSIL/DarkVigil_AGen.D. Full IoCs: github.com/eset/malware-ioc (slippynunchucks).","fix":"Update Sogou Input Method for Windows to 16.10 or later now. Hunt for the files, registry value, domains and IPs above, and block those domains and IPs. Treat any machine with a hit as compromised: isolate it, reimage it, and rotate credentials used on it. Check that routers and DNS resolvers have not been tampered with.","status":"open","published_at":null,"first_seen_at":"2026-11-04T10:23:32+00:00","triaged_at":"2026-11-04T10:23:32+00:00","updated_at":"2026-11-04T10:24:59+00:00","category":"vendor","confidence":null,"triage":null,"analyst_status":"done","analyst_note":null,"search":"'-01':65B '-07':64B '-09':53B '-15':54B '-202611':26A '-26':27A '16.10':179B '20':123B '2023':52B '2026':63B,183B 'abroad':23A 'activ':48B 'adob':99B 'align':3A,45B 'attack':82B 'backdoor':19A,106B 'binari':100B 'brand':74B 'brand-vocabulari':73B 'c':133B,134B 'campaign':35B 'certif':191B 'cfz5':28A 'china':2A,44B 'china-align':1A,43B 'chines':21A,139B 'chinese-speak':138B 'cmp':25A 'com':61B 'compon':111B,117B 'compromis':163B 'config':13A,76B,88B 'config.pinyin.sogou':60B 'confirm':135B 'darkvigil':18A,30A,103B,121B 'disguis':97B 'dispatch':94B 'dll':107B 'dmtp':131B 'dns':57B,160B 'download':95B 'e.g':125B 'earli':37B 'early-warn':36B 'end':180B 'eset':24A,39B,154B 'fdmtp':31A,104B 'fetch':71B 'fix':173B 'folder':112B 'getbrandscd.php':77B 'group':46B 'happen':162B 'hijack':5A,56B 'hong':145B 'http':80B 'https':189B 'individu':143B 'input':7A,33A,67B,177B 'instal':16A 'intercept':169B 'isp':167B 'isp-level':166B 'japan':148B 'know':157B 'kong':146B 'lanka':153B 'least':51B 'level':168B 'made':90B 'malici':87B 'method':8A,34A,68B,178B 'move':185B 'net':105B 'octob':182B 'oman':150B 'organis':141B 'pillag':127B 'pin':192B 'pinyin':10A 'plain':79B 'plugin':124B 'possibl':171B 'report':40B 'request':187B 'resolut':58B 'return':85B 'router':164B 'run':119B 'server':84B 'sgtool.exe':92B 'sign':98B 'sinc':49B,62B 'slippynunchuck':4A,47B 'slippynunchucks':29A 'sogou':6A,9A,32A,66B,110B,114B,176B 'speak':140B 'speaker':22A 'sri':152B 'stealer':128B 'tamper':161B 'task':93B 'tencent':172B 'thailand':147B 'traffic':14A 'use':130B 'victim':136B 'vietnam':149B 'vocabulari':75B 'warn':38B 'window':12A,70B 'workflow':118B","nicknames":["SlippyNunchucks","DarkVigil","FDMTP"],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["darkvigil","fdmtp","inputmethod","slippynunchucks","sogouinputmethod"],"ptokens":["input","method","sogou"],"labels":["campaign","earlywarning","high","vendor"],"campaign_type":"supply-chain","first_public_at":"2026-11-04T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202611-26cfz5","url":null,"severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-04T10:23:32+00:00","fetched_at":"2026-11-04T10:23:32+00:00","note":null}],"documents":[{"id":65985,"url":"https://x.com/ESETresearch/status/2117920053370745063","title":"@ESETresearch: #ESETresearch has uncovered a surveillance method used to target Chinese speaker","kind":"post","source":"x","publisher":null,"text":"#ESETresearch has uncovered a surveillance method used to target Chinese speakers abroad. The threat actor, 🇨🇳 China-aligned SlippyNunchucks, hijacked DNS resolution for Sogou Input Method traffic to facilitate malware delivery. https://t.co/MwRraozHUY 1/7 https://t.co/nQObdPj0ro\n\nlikes 6 reposts 2","published_at":"2026-11-04T10:01:04+00:00","relation":"describes","confidence":null,"note":null},{"id":65984,"url":"https://x.com/ESETresearch/status/2117920054910046228","title":"@ESETresearch: Sogou Input Method (also known as Sogou Pinyin) is one of the most widely used C","kind":"post","source":"x","publisher":null,"text":"Sogou Input Method (also known as Sogou Pinyin) is one of the most widely used Chinese input method editors (IMEs) for typing Chinese characters on computers and mobile devices. 2/7 https://t.co/a7INqK3iR6\n\nlikes 1 reposts 0","published_at":"2026-11-04T10:01:04+00:00","relation":"describes","confidence":null,"note":null},{"id":65983,"url":"https://x.com/ESETresearch/status/2117920056084496647","title":"@ESETresearch: In the victim environment, the attacker controlled the DNS resolution for config","kind":"post","source":"x","publisher":null,"text":"In the victim environment, the attacker controlled the DNS resolution for config.pinyin.sogou[.]com. When the application requested a configuration related to a branded vocabulary dictionary, the hijacking server responded with a malicious configuration. 3/7\n\nlikes 1 reposts 0","published_at":"2026-11-04T10:01:05+00:00","relation":"describes","confidence":null,"note":null},{"id":65982,"url":"https://x.com/ESETresearch/status/2117920056998838377","title":"@ESETresearch: In April 2016, Sogou introduced the Startup Brand Support Program (创业品牌支持计划), al","kind":"post","source":"x","publisher":null,"text":"In April 2016, Sogou introduced the Startup Brand Support Program (创业品牌支持计划), allowing startups to submit their brand names for inclusion in the IME’s vocabulary. The targeted request is used to retrieve the icons associated with this program. 4/7\n\nlikes 1 reposts 0","published_at":"2026-11-04T10:01:05+00:00","relation":"describes","confidence":null,"note":null},{"id":65981,"url":"https://x.com/ESETresearch/status/2117920057850306771","title":"@ESETresearch: The malicious config instructs the task dispatcher SGTool.exe to download payloa","kind":"post","source":"x","publisher":null,"text":"The malicious config instructs the task dispatcher SGTool.exe to download payloads to selected locations, leveraging Sogou Input Method’s existing component management workflows for execution. 5/7\n\nlikes 1 reposts 0","published_at":"2026-11-04T10:01:05+00:00","relation":"describes","confidence":null,"note":null},{"id":65980,"url":"https://x.com/ESETresearch/status/2117920058735219195","title":"@ESETresearch: DarkVigil implements a unique C&amp;C architecture using DMTP, a network protoco","kind":"post","source":"x","publisher":null,"text":"DarkVigil implements a unique C&amp;C architecture using DMTP, a network protocol. This architecture is analyzed in detail in our blogpost. 6/7\n\nlikes 0 reposts 0","published_at":"2026-11-04T10:01:05+00:00","relation":"describes","confidence":null,"note":null},{"id":65979,"url":"https://x.com/ESETresearch/status/2117920059540615260","title":"@ESETresearch: IoCs available in our GitHub repo: https://t.co/hPXap467eI 7/7","kind":"post","source":"x","publisher":null,"text":"IoCs available in our GitHub repo: https://t.co/hPXap467eI 7/7\n\nlikes 3 reposts 0","published_at":"2026-11-04T10:01:05+00:00","relation":"describes","confidence":null,"note":null},{"id":65997,"url":"https://www.welivesecurity.com/en/eset-research/slippynunchucks-hijacks-sogou-input-methods-brand-promotion-mechanism-to-distribute-malware/","title":"SlippyNunchucks hijacks Sogou Input Method's brand promotion mechanism to distribute malware (ESET Research)","kind":"blog","source":"analyst","publisher":null,"text":"ESET: China-aligned SlippyNunchucks (active since at least 2023-09-15) hijacked DNS for config.pinyin.sogou[.]com from 2026-07-01; Sogou Input Method for Windows requested getBrandScd.php over plain HTTP, malicious config made SGTool.exe download a disguised Adobe binary (biz_helper.exe) and DarkVigil (FDMTP) .NET backdoor DLL (libcef.dll) into Components folder. Victims Chinese speakers in Hong Kong, Thailand, Japan, Vietnam, Oman, Sri Lanka. Tencent fixed in 16.10 (end Oct 2026) with HTTPS and cert pinning. IoCs: sogou-cdn[.]com, dev.soft-png-cdn[.]com, blog.wangmengfun[.]top, update.mssproxy[.]net, img.fusfun[.]top; 47.237.122[.]175, 47.239.250[.]102, 47.236.254[.]159, 47.86.15[.]162; SHA-1 8A60A8E90E1F5F08F28FE5A6DD57BD686C20DC23 (libcef.dll), 3E16BA611782AF6E45576D390488D28FD676BADE, 79188C8DE2378B437D39E867475C5B4714A0D7C9 (biz_helper.exe); HKCU\\Software\\Microsoft\\IME\\<HWID>\\pluginHash. Full IoCs github.com/eset/malware-ioc/slippynunchucks.","published_at":"2026-11-04T00:00:00+00:00","relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}