Threat intel

Hijacked Sogou config requests deliver DarkVigil spyware

By Yaali. November 7, 2026, 5 min read, Threat intel, Supply chain, Windows.

A China-aligned group forged DNS answers to Sogou Input Method's plain HTTP config fetch to plant DarkVigil. Update to 16.10, block the old path and hunt.

ESET published research on November 4 showing that a China-aligned espionage group it calls SlippyNunchucks has been planting its DarkVigil implant through Sogou Input Method, Tencent's Chinese input method editor (IME) for Windows. A Sogou component fetched a brand-promotion configuration over unencrypted HTTP. The attackers forged the DNS (Domain Name System) answer for that request, served their own configuration, and Sogou installed the malware itself. The flaw is tracked as CVE-2026-120422.

If any Windows machine you manage has Sogou Input Method older than version 16.10, it is exposed. The campaign has run since July 1, 2026, against organisations and Chinese-speaking individuals in Hong Kong, Thailand, Japan, Vietnam, Oman and Sri Lanka. The hijack happens on the network path, and ESET has not found where, so the exposure is not limited to those countries.

How it works

Sogou ships a helper called SGTool.exe, a legitimate multipurpose task dispatcher. One of those jobs pulls the settings for Sogou's branded vocabulary promotion from config.pinyin.sogou.com/api/brandScd/getBrandScd.php. Before 16.10 that request went over plain HTTP, so the client had no way to confirm it was talking to Sogou.

Without TLS (Transport Layer Security), whoever controls the DNS answer controls the response. In victims' networks, the config host resolved to attacker staging servers behind the domain sogou-cdn[.]com. Those servers returned a configuration that told Sogou to download attacker files and save them in its own install folder, in places that Sogou's normal workflows later execute. The malware then runs whenever Sogou does routine work, with no separate persistence step to spot.

The payload pair is classic DLL side-loading, where a trusted program is tricked into loading a malicious library sitting next to it. A legitimate Adobe executable renamed biz_helper.exe loads a rogue libcef.dll, which is the DarkVigil implant.

Where the DNS answers were forged is still open. ESET and Infosecurity Magazine both list maliciously configured routers, implanted routers or interception at the internet service provider as possibilities. Each of those sits outside the endpoint, so endpoint hardening alone would not have stopped the redirect.

What attackers are doing

DarkVigil, which other vendors call FDMTP, is a modular .NET toolset with more than 20 plugins. It talks to its command-and-control servers over DMTP (Duplex Message Transport Protocol), and new capabilities are pushed to the victim as plugins after the initial install.

SlippyNunchucks has been active since at least September 15, 2023. Before Sogou, it spread DarkVigil through a supply-chain compromise of QuickFox, and ESET lists QingTalk, MiYunChat, SoftCam and tawk.to among other software it has abused. Named victims include a multinational gambling organisation operating in Sri Lanka, the Philippines and Hong Kong, an internet café in Dubai, and a university student in Denmark. ESET assesses with high confidence that the group serves a Chinese nation-state surveillance effort.

Attribution is disputed. Darktrace has linked FDMTP to Mustang Panda (also tracked as Twill Typhoon) with moderate confidence. ESET says its telemetry shows no overlap between DarkVigil activity and Mustang Panda, and it tracks SlippyNunchucks as a separate group. The indicators below are specific to this campaign either way.

ESET reported the issue to Tencent on September 11, and Tencent acknowledged it on September 21. Sogou Input Method 16.10, released on October 29, moves the affected requests to HTTPS and enables certificate pinning, so the client now rejects a server that cannot present Sogou's expected certificate. ESET's write-up gives October 30 for the release in one place, so expect builds dated either day.

What to do

1. Find every install. Input methods are often installed by users, so check endpoints outside your managed catalogue. In PowerShell, Get-ItemProperty HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*, HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* | Where-Object DisplayName -like '*Sogou*' | Select DisplayName, DisplayVersion lists the installed name and version. Most endpoint management and EDR (endpoint detection and response) inventories can run the same filter across the fleet.
2. Update to 16.10 or later. That is the first build with HTTPS and pinning on the affected requests. If Sogou is not needed for work, uninstalling it removes the exposure entirely.
3. If you cannot update today, block outbound TCP 80 to config.pinyin.sogou.com at the web proxy or firewall. An old client then cannot fetch the brand config in clear text. Also block the attacker domains and IP addresses listed below.
4. Check DNS. Search resolver and proxy logs from June 2026 onward for config.pinyin.sogou.com resolving to 47.237.122[.]175, 47.239.250[.]102 or 47.236.254[.]159, and for any lookup of sogou-cdn[.]com or dev.soft-png-cdn[.]com. A hijack upstream of your resolver may not show in your own DNS logs, so also look at the destination IP on proxy and firewall flows for that hostname.
5. Hunt for the implant. Look for libcef.dll or an Adobe executable inside the Sogou install folder, and for traffic to the DarkVigil bootstrap servers. In Microsoft Defender Advanced Hunting: DeviceFileEvents | where FolderPath has "Sogou" and FileName in~ ("libcef.dll", "biz_helper.exe"), and DeviceNetworkEvents | where RemoteUrl has_any ("wangmengfun.top", "mssproxy.net", "fusfun.top", "sogou-cdn.com", "soft-png-cdn.com") or RemoteIP in ("47.86.15.162", "47.236.254.159", "47.237.122.175", "47.239.250.102").
6. If you find it, isolate and rebuild the machine rather than cleaning it, because DarkVigil can pull new plugins at any time. Reset passwords and tokens used on that machine, and audit the DNS settings and firmware of the router or resolver it used, since that is where the hijack may sit.

ESET's published indicators:

• Hijacking domains: sogou-cdn[.]com, dev.soft-png-cdn[.]com
• DarkVigil bootstrap domains: blog.wangmengfun[.]top, update.mssproxy[.]net, img.fusfun[.]top
• IP addresses: 47.237.122[.]175, 47.239.250[.]102, 47.236.254[.]159, 47.86.15[.]162
• SHA-1 8A60A8E90E1F5F08F28FE5A6DD57BD686C20DC23 (libcef.dll, DarkVigil implant)
• SHA-1 3E16BA611782AF6E45576D390488D28FD676BADE (DarkVigil .NET implant DLL)

Plain HTTP update channels

Any software that fetches configuration, update manifests or download lists over plain HTTP hands control of the endpoint to whoever controls the network path. A checksum in the same response does not help, because the attacker writes the checksum too. The questions to ask of every auto-updater in your estate are whether it uses TLS, whether it validates the certificate, and whether it checks a code signature on what it downloads before running it.

A proxy report of executables or software configs fetched over port 80 by desktop agents is a quick way to find the next Sogou. Treat input methods, browser helpers and chat clients with the same suspicion as anything else that runs in every user session.

Our security operations team can run these DNS and endpoint hunts across your fleet, and our safeguarding and hardening work covers auditing software update channels and egress rules. Open the chat and Yaali, our AI agent, will pass your question to an engineer.

Sources: ESET newsroom, ESET WeLiveSecurity technical report, ESET indicators of compromise on GitHub, The Hacker News, Infosecurity Magazine.