Skip to content
NewA calmer, faster ZeroHour
StoryThreat actorhighExploited in the wild

SlippyNunchucks hijacks Sogou updates to install DarkVigil

2 sources · 2 articlesFirst reported Updated ()
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

ESET says China-aligned SlippyNunchucks used DNS hijacking of Sogou updates to deploy DarkVigil; Tencent fixed it in version 16.10.

ESET reports that China-aligned group SlippyNunchucks redirected Sogou Input Method configuration checks by hijacking DNS answers for unencrypted HTTP requests, starting July 1, 2026. Forged settings caused SGTool.exe to side-load the modular .NET implant DarkVigil beside a signed Adobe helper. Victims were in Hong Kong, Thailand, Japan, Vietnam, Sri Lanka, Oman, and other locations. Tencent patched the flaw, tracked as CVE-2026-120422, in version 16.10 after ESET disclosed it in September. ESET assesses Chinese state alignment with high confidence, says it does not attribute the group to Mustang Panda, and has not identified whether the hijack occurred at routers or an ISP.

Key facts
  • Campaign used Sogou update channels from July 1, 2026.
  • CVE-2026-120422 covers the plain-HTTP configuration flaw.
  • Fixed in Sogou Input Method 16.10 or later.
  • DarkVigil is a modular .NET backdoor with more than 20 plugins.
  • Staging IPs cited: 47.239.250.102 and 47.237.122.175.
  • ESET has tracked the group since at least September 2023.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Sep 1, 2023SlippyNunchucks assessed active since at least September 2023 · GBHackers
  2. Jul 1, 2026DNS hijacking of Sogou HTTP config checks begins · Cyber Security News

What each outlet adds

beyond the shared facts
  • GBHackersNames staging IPs and says the group was active from September 2023.
  • Cyber Security NewsDates the hijack to July 1, rules out Mustang Panda, and notes DMTP.
CVEs
CVE-2026-120422
Vendors
TencentESET
Products
Sogou Input Method
Threat actors
SlippyNunchucks
Malware
DarkVigilFDMTP
Victims
gambling operator in Sri LankaPhilippinesHong KongInternet café in Dubaistudent in Denmark
Organizations
ESET
Countries
Hong KongThailandJapanVietnamSri LankaOmanDenmark

Coverage

oldest first · one row per article · UTC
  1. · 6d ago GBHackersFirst report

    China-Aligned Hackers Hijack Sogou Keyboard App to Install DarkVigil Malware

    ESET tracks China-aligned group SlippyNunchucks abusing Sogou Input Method updates via DNS hijacking to deploy DarkVigil since mid-2026.

  2. · 6d ago Cyber Security News

    SlippyNunchucks deploys DarkVigil through Sogou Input Method

    ESET says DNS answers for plain-HTTP config checks were hijacked from July 1, 2026; Tencent fixed it in 16.10.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-120422
HTTP config retrieval in Sogou Input Method for Windows
8.9—