China-Aligned Hackers Hijack Sogou Keyboard App to Install DarkVigil Malware
Original title: China-Aligned Hackers Hijack Popular Sogou Keyboard Software to Secretly Install DarkVigil Malware
ESET tracks China-aligned group SlippyNunchucks abusing Sogou Input Method updates via DNS hijacking to deploy DarkVigil since mid-2026.
A China-aligned espionage group abused the update traffic of the popular Sogou Input Method keyboard app to install the DarkVigil implant. ESET Research tracked the actor as SlippyNunchucks and reported the campaign targeting victims in Hong Kong, Thailand, Japan, Vietnam, Sri Lanka, Oman, and others. The group used DNS hijacking to serve forged configurations over unencrypted HTTP, leading to side-loaded malicious files that run as legitimate components. Tencent patched the flaw in version 16.10 after ESET disclosed it in September.
Unconfirmed: The exact location where DNS manipulation occurs remains unknown
- Victims received DarkVigil through Sogou update channels from July 2026
- DNS hijacking resolved targets to staging IPs 47.239.250[.]102 and 47.237.122[.]175
- CVE-2026-120422 assigned to the Sogou HTTP flaw
- DarkVigil is a modular .NET implant with 20+ plugins
- Group active since at least September 2023
Impact: secretly install DarkVigil malware via abused keyboard app
- 1.Update Sogou Input Method to version 16.10
- 2.Secure routers and DNS settings
- 3.Hunt for sogou-cdn[.]com and related IOCs
- CVEs
- CVE-2026-120422
- Products
- Sogou Input Method
- Threat actors
- SlippyNunchucks
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-120422 | HTTP config retrieval in Sogou Input Method for Windows | 8.9 | — |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | fusfun.top | xy[.]net N/A 2026‑08‑06 DarkVigil bootstrap server. N/A img.fusfun[.]top N/A 2026‑08‑06 DarkVigil bootstrap server. Note: IP addre |
| domain | mssproxy.net | .]top N/A 2026‑07‑08 DarkVigil bootstrap domain. N/A update.mssproxy[.]net N/A 2026‑08‑06 DarkVigil bootstrap server. N/A img.fusfun |
| domain | sogou-cdn.com | he configuration told SGTool.exe to download two files from sogou-cdn[.]com. One was a legitimate, signed Adobe Licensing WF Helper r |
| domain | sogou.com | nent SGTool.exe requests a configuration from config.pinyin.sogou[.]com/api/brandScd/getBrandScd.php. The request belongs to the |
| domain | wangmengfun.top | IOCs IP Domain Hosting provider First seen Details N/A blog.wangmengfun[.]top N/A 2026‑07‑08 DarkVigil bootstrap domain. N/A update.mss |
| ipv4 | 47.239.250.102 | rks, the attacker resolved the domain to staging servers at 47.239.250[.]102 or 47.237.122[.]175. Those servers returned a forged AES- |
From the original article
3 min read at gbhackers.com
A China-aligned espionage group abused the update traffic of Sogou Input Method, one of China’s most widely used keyboard apps, to quietly install the DarkVigil implant on victims’ machines. ESET Research, which tracks the actor as SlippyNunchucks, published its findings on November 4, 2026. Tencent, which owns Sogou, has patched the flaw in version 16.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.