A Chinese-Aligned Group Hijacked Sogou Input Method's Update Check Over Plain HTTP to Plant DarkVigil. The Fix Is Version 16.10, and ESET Says Other Concerns Remain.
If Sogou Input Method for Windows is installed on any machine you manage, update it to version 16.10 and look for the files listed below. ESET Research reported on November 4 that a group it calls SlippyNunchucks has been redirecting the app's brand-promotion update check to its own servers since at least July 1, and using it to deliver a backdoor ESET calls DarkVigil.
How the attack works
The weak point is a request the app makes over HTTP. ESET says Sogou's updater tool, SGTool.exe, asks config.pinyin.sogou.com for a brand-promotion configuration, and that 20 endpoints on that host are fetched over plain HTTP. The attacker controls how that hostname resolves. ESET says where the DNS manipulation happens is unknown, so we cannot tell you whether it is at the network edge, at the resolver or somewhere else.
What the victim's app then receives is an encrypted configuration from the attacker's staging server. The configuration tells the updater to download two files from a lookalike domain, sogou-cdn.com: a legitimate Adobe binary renamed biz_helper.exe, and the implant libcef.dll. The attacker edited the checksum fields so the updater accepts both. The Adobe binary is saved under the name SogouComMgr.exe in the Components folder, so the app's own calls run it, and it loads libcef.dll from the same folder. That is DLL side-loading: a signed, legitimate program is the loader.
ESET describes a second path through a versioned biz_center folder, and says DarkVigil stores its plugins in the registry under HKCU\Software\Microsoft\IME, keyed by a hardware identifier, and talks to its command servers over a protocol ESET calls DMTP.
Who and where
ESET says it observed DarkVigil being launched from July 1, 2026. Victims are in Hong Kong, Thailand, Japan, Vietnam, Sri Lanka and Oman, with occasional victims in Germany, Russia, the United Kingdom and Austria. ESET assesses with high confidence that SlippyNunchucks is tied to a Chinese-government-aligned surveillance effort, and says it found no overlap with Mustang Panda, which earlier public reporting had suggested. The Hacker News words it more loosely, as suspected to operate in the Chinese government's interests.
The CVE is CVE-2026-120422. ESET's own timeline says its CVE authority issued the ID on November 2. The Hacker News also mentions an earlier Sogou case, CVE-2026-51990, that another group used to deliver a different backdoor; we did not read that report.
The fix, and what is left
Tencent shipped version 16.10, which moves the affected requests to HTTPS and turns on certificate pinning. The sources disagree on the date: The Hacker News says October 29, and ESET gives both October 29 and October 30 in different places. ESET also says other security concerns remain, naming file-type validation and download-destination restrictions, which the fix does not cover. So 16.10 closes the hijack path ESET found; it does not make the updater safe.
What to look for
Files named SogouComMgr.exe or libcef.dll in the SogouInput Components folder, and anything under Components\biz_center.
Registry keys under HKCU\Software\Microsoft\IME that carry a hardware-ID subkey with a pluginHash value.
Network traffic from Sogou's updater to sogou-cdn.com, dev.soft-png-cdn.com, or the other domains and addresses in the feed list below.
The two implant hashes (SHA-1) in the feed: 8A60A8E90E1F5F08F28FE5A6DD57BD686C20DC23 for libcef.dll, and 3E16BA611782AF6E45576D390488D28FD676BADE for a second implant DLL. We did not ingest the hash of the renamed Adobe binary, because it is a legitimate file that ESET says was abused as a loader, and a blocklist entry for it would break real Adobe software.
If you cannot patch, block the Sogou configuration host for the app at your proxy, or block the app's outbound HTTP, until you can. Treat any machine where the files above appear as compromised, not merely infected.
What we hold
We ingested ESET's published network indicators and the two implant hashes, credited to ESET, under the source label manual-batch-slippynunchucks-sogou-2026-11: four IP addresses (the three staging servers and the bootstrap server on Alibaba Cloud Hong Kong) and five domains (dev.soft-png-cdn.com, sogou-cdn.com, blog.wangmengfun.top, update.mssproxy.net and img.fusfun.top). We did not ingest config.pinyin.sogou.com. It is Sogou's real hostname and the victim's side of the redirect, not an attacker domain.
We ran the four IP addresses against our edge since October 5: 43,467 edge block records, about 24,000 canary records and 1,229 origin honeypot records. Zero matches on all four. That says those addresses did not touch our edge, not that nobody was hit. We read ESET's report like everyone else, and we are not claiming a lead.
Limits
We read ESET's report and The Hacker News's summary of it. We did not open ESET's indicator repository, did not reproduce anything, and did not see a sample. ESET gives no affected version range, so we cannot say how far back the vulnerable app goes. No source says CISA has listed this.
Five percent of this is wrong somewhere. It always is. The numbers will move again before you finish reading.
Was this useful? Rate this post. The widget is at the bottom of the page, and we read every response.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.
Comments