SlippyNunchucks Exploits Sogou DNS Hijacking to Deploy DarkVigil Surveillance Malware

China-aligned threat group SlippyNunchucks exploited insecure configuration retrieval in Sogou Input Method for Windows to deploy the DarkVigil toolset in a surveillance campaign observed since July 1, 2026. ESET reported victims across six countries, including organizations and Chinese-speaking individuals abroad, and assessed with high confidence that the group supports surveillance aligned with Chinese government interests. Attackers manipulated DNS resolution for config.pinyin.sogou[.]com, redirecting unencrypted HTTP requests to attacker-controlled servers. Malicious brand-promotion configurations instructed Sogou’s SGTool.exe component to download payloads to attacker-selected locations, enabling DLL sideloading and persistence. The underlying weakness is tracked as CVE-2026-120422; where the DNS manipulation occurred remains unknown.

Tencent released Sogou Input Method 16.10 on October 29, moving the affected requests to HTTPS and enabling certificate pinning. Organizations running Sogou should prioritize upgrading and investigate potentially exposed endpoints using ESET’s published indicators of compromise. Relevant investigation areas include suspicious DNS responses, SGTool.exe downloads, and unexpected DLL loading or persistence. ESET cautioned that the downloader still lacks downloaded-file-type validation and save-location restrictions, leaving residual hardening gaps despite the transport-security fix. DarkVigil also uses a distinctive command-and-control architecture based on the DMTP network protocol.