--- id: "CMP-202611-26cfz5" kind: "campaign" aliases: [] title: "China-aligned SlippyNunchucks hijacks Sogou Input Method (Sogou Pinyin) for Windows config traffic to install the DarkVigil backdoor on Chinese speakers abroad (ESET)" severity: "high" cvss: null epss: null exploited: true status: "open" category: "vendor" products: [{"name": "Sogou Input Method", "fixed": [], "vendor": "Tencent", "fixed_in": "16.10", "platform": "Windows"}] ecosystems: [] tags: ["campaign", "early-warning"] not_affected_if: [] published_at: null first_seen_at: "2026-11-04T10:23:32+00:00" updated_at: "2026-11-04T10:24:59+00:00" sources: [{"source": "analyst", "url": null, "first_seen_at": "2026-11-04T10:23:32+00:00"}] --- # China-aligned SlippyNunchucks hijacks Sogou Input Method (Sogou Pinyin) for Windows config traffic to install the DarkVigil backdoor on Chinese speakers abroad (ESET) ESET reports that the China-aligned group SlippyNunchucks (active since at least 2023-09-15) has hijacked DNS resolution for config.pinyin.sogou[.]com since 2026-07-01. Sogou Input Method for Windows fetched its brand-vocabulary config (getBrandScd.php) over plain HTTP. The attacker's server returned a malicious config that made the SGTool.exe task dispatcher download a disguised signed Adobe binary and the DarkVigil (FDMTP) .NET backdoor DLL into the Sogou Components folder, where Sogou's own component workflow runs them. DarkVigil has 20+ plugins (e.g. the Pillager stealer) and uses DMTP for C&C. Confirmed victims are Chinese-speaking organisations and individuals in Hong Kong, Thailand, Japan, Vietnam, Oman and Sri Lanka. ESET does not know where the DNS tampering happens (compromised routers or ISP-level interception are possible). Tencent fixed it in Sogou Input Method 16.10 (end of October 2026), which moves the requests to HTTPS with certificate pinning. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - :Sogou Input Method affected ? fixed ? ## How to check Windows machines running Sogou Input Method older than 16.10. In the Sogou install, look for \Components\SogouComMgr.exe replaced by a different binary, \Components\libcef.dll, \Components\biz_center\\, and the registry value HKCU\Software\Microsoft\IME\\pluginHash. SHA-1: 8A60A8E90E1F5F08F28FE5A6DD57BD686C20DC23 (libcef.dll, DarkVigil), 3E16BA611782AF6E45576D390488D28FD676BADE (Microsoft.VisualStudio.HostingProcess.Utilities.Sync.dll, DarkVigil), 79188C8DE2378B437D39E867475C5B4714A0D7C9 (biz_helper.exe, abused Adobe binary). Domains: sogou-cdn[.]com, dev.soft-png-cdn[.]com, blog.wangmengfun[.]top, update.mssproxy[.]net, img.fusfun[.]top. IPs: 47.237.122[.]175, 47.239.250[.]102, 47.236.254[.]159, 47.86.15[.]162. Also look for config.pinyin.sogou[.]com resolving to unexpected IPs. ESET detections: Win64/Agent.KSV, MSIL/DarkVigil_AGen.D. Full IoCs: github.com/eset/malware-ioc (slippynunchucks). ## Fix Update Sogou Input Method for Windows to 16.10 or later now. Hunt for the files, registry value, domains and IPs above, and block those domains and IPs. Treat any machine with a hit as compromised: isolate it, reimage it, and rotate credentials used on it. Check that routers and DNS resolvers have not been tampered with. ## Timeline - 2026-11-04T10:23:32+00:00 analyst ## Documents - [describes] @ESETresearch: #ESETresearch has uncovered a surveillance method used to target Chinese speaker https://x.com/ESETresearch/status/2117920053370745063 - [describes] @ESETresearch: Sogou Input Method (also known as Sogou Pinyin) is one of the most widely used C https://x.com/ESETresearch/status/2117920054910046228 - [describes] @ESETresearch: In the victim environment, the attacker controlled the DNS resolution for config https://x.com/ESETresearch/status/2117920056084496647 - [describes] @ESETresearch: In April 2016, Sogou introduced the Startup Brand Support Program (创业品牌支持计划), al https://x.com/ESETresearch/status/2117920056998838377 - [describes] @ESETresearch: The malicious config instructs the task dispatcher SGTool.exe to download payloa https://x.com/ESETresearch/status/2117920057850306771 - [describes] @ESETresearch: DarkVigil implements a unique C&C architecture using DMTP, a network protoco https://x.com/ESETresearch/status/2117920058735219195 - [describes] @ESETresearch: IoCs available in our GitHub repo: https://t.co/hPXap467eI 7/7 https://x.com/ESETresearch/status/2117920059540615260 - [describes] SlippyNunchucks hijacks Sogou Input Method's brand promotion mechanism to distribute malware (ESET Research) https://www.welivesecurity.com/en/eset-research/slippynunchucks-hijacks-sogou-input-methods-brand-promotion-mechanism-to-distribute-malware/ --- _Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_