Skip to content
NewA calmer, faster ZeroHour
Threat actorhighExploited in the wild

SlippyNunchucks deploys DarkVigil through Sogou Input Method

Original title: Hackers Turn Popular Chinese Keyboard Software Into a Backdoor for Cyberespionage Attacks

Cyber Security Newsby Tushar Subhra Dutta ()4 min read4 · 2 reads
Read at cybersecuritynews.com
Part of a story covered by 2 sourcesSlippyNunchucks hijacks Sogou updates to install DarkVigilMerged summary & timeline
AI summary · x-ai/grok-4.7Summaries by Vani AI

ESET says DNS answers for plain-HTTP config checks were hijacked from July 1, 2026; Tencent fixed it in 16.10.

Since July 1, 2026, SlippyNunchucks redirected Sogou Input Method configuration requests by tampering with DNS answers for plain HTTP calls. Fake settings made SGTool.exe side-load DarkVigil beside a signed Adobe helper. Tencent patched the issue in version 16.10 as CVE-2026-120422. ESET has tracked the modular .NET backdoor since early 2025 and assesses Chinese state alignment with high confidence.

Unconfirmed: ESET says the DNS hijack point is unknown and does not link the group to Mustang Panda, despite some public reports.

Key facts
  • Targets include Hong Kong, Thailand, Japan, Vietnam, Sri Lanka and Oman.
  • DarkVigil has more than 20 plugins and uses DMTP.
  • The hijack point, routers or an ISP, remains unknown.
  • ESET does not attribute the group to Mustang Panda.
  • Users should update Sogou Input Method to 16.10 or later.
Security assessment · AI, from the articleExploited in the wild

Impact: persistent backdoor access and modular espionage plugins

ProductAffectedFixed in
Tencent Sogou Input Method—16.10
What to do
  1. 1.Update Sogou Input Method to version 16.10 or later.
  2. 2.Look for listed domains, IPs, and odd Adobe-named files in Sogou’s Components folder.
  3. 3.Check router DNS settings for hijacking.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat
CVEs
CVE-2026-120422
ATT&CK
T1574.002 DLL Side-LoadingT1112 Modify RegistryT1071 Application Layer Protocol
Tags
sogoudarkvigilslippynunchucksdns-hijackingdll-sideloadingespionage
Vendors
Tencent
Products
Sogou Input Method
Threat actors
SlippyNunchucks
Malware
DarkVigil
Organizations
ESET
Countries
Hong KongThailandJapanVietnamSri LankaOman

Vulnerabilities mentioned

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-120422
HTTP config retrieval in Sogou Input Method for Windows
8.9—

Indicators of compromise

auto-extracted · verify before use · export allAll
TypeIndicatorContext
domainfusfun.topoxy[.]net N/A 2026-08-06 DarkVigil bootstrap server N/A img.fusfun[.]top N/A 2026-08-06 DarkVigil bootstrap server 47.86.15[.]162
domainmssproxy.net[.]top N/A 2026-07-08 DarkVigil bootstrap domain N/A update.mssproxy[.]net N/A 2026-08-06 DarkVigil bootstrap server N/A img.fusfun[
domainsoft-png-cdn.com2026-08-08 DarkVigil bootstrap server 47.236.254[.]159 dev.soft-png-cdn[.]com Alibaba (US) Technology Co., Ltd. 2026-06-07 Hijacking do
domainsogou-cdn.com-06-07 Hijacking domain and staging server 47.237.122[.]175 sogou-cdn[.]com Alibaba (US) Technology Co., Ltd. 2026-07-21 Hijacking do
domainsogou.comu part called SGTool.exe. It asks a server at config.pinyin.sogou[.]com for a small settings file that tells it which icon to dow
domainwangmengfun.toptors IP Domain Hosting provider First seen Details N/A blog.wangmengfun[.]top N/A 2026-07-08 DarkVigil bootstrap domain N/A update.mssp
ipv447.236.254.159/A Alibaba Cloud – HK 2026-08-08 DarkVigil bootstrap server 47.236.254[.]159 dev.soft-png-cdn[.]com Alibaba (US) Technology Co., Ltd.
ipv447.237.122.175gy Co., Ltd. 2026-06-07 Hijacking domain and staging server 47.237.122[.]175 sogou-cdn[.]com Alibaba (US) Technology Co., Ltd. 2026-07
ipv447.239.250.102gy Co., Ltd. 2026-07-21 Hijacking domain and staging server 47.239.250[.]102 sogou-cdn[.]com Alibaba (US) Technology Co., Ltd. 2026-07
ipv447.86.15.162img.fusfun[.]top N/A 2026-08-06 DarkVigil bootstrap server 47.86.15[.]162 N/A Alibaba Cloud – HK 2026-08-08 DarkVigil bootstrap ser
sha13e16ba611782af6e45576d390488d28fd676bade57BD686C20DC23 libcef.dll Win64/Agent.KSV DarkVigil implant 3E16BA611782AF6E45576D390488D28FD676BADE Microsoft.VisualStudio.HostingProcess.Utilities.Sync.dll MS
sha179188c8de2378b437d39e867475c5b4714a0d7c9.Utilities.Sync.dll MSIL/DarkVigil_AGen.D DarkVigil implant 79188C8DE2378B437D39E867475C5B4714A0D7C9 biz_helper.exe Legitimate signed Adobe Licensing WF Helper,
sha18a60a8e90e1f5f08f28fe5a6dd57bd686c20dc23oCs):- Malicious files SHA-1 Filename Detection Description 8A60A8E90E1F5F08F28FE5A6DD57BD686C20DC23 libcef.dll Win64/Agent.KSV DarkVigil implant 3E16BA611782AF

From the original article

4 min read at cybersecuritynews.com

A China-aligned hacking group is abusing Sogou Input Method, one of the most popular Chinese typing tools, to secretly install a backdoor called DarkVigil on Windows computers. The group is tracked as SlippyNunchucks. Since July 1, 2026, it has used the keyboard software to reach users in Hong Kong, Thailand, Japan, Vietnam, Sri Lanka and […]

Cyber Security News

By Tushar Subhra Dutta · cybersecuritynews.com

Read the full article at Cyber Security News

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.