SlippyNunchucks Poisons Sogou DNS to Plant DarkVigil

Red | Attack

SlippyNunchucks Poisons Sogou DNS to Plant DarkVigil | Hive Pro Threat Advisory

Threat Advisory · Attack Report

SlippyNunchucks Poisons Sogou DNS to Plant DarkVigil

SlippyNunchucks hijacked DNS so a plain-HTTP Sogou Input Method update check reached an attacker server and loaded the DarkVigil (FDMTP) backdoor, with no exploit or phishing required. Tencent fixed CVE-2026-120422 in version 16.10.

Attack ReportTA2026326Admiralty Code A1SlippyNunchucksDarkVigilFDMTPCVE-2026-120422Sogou Input Method

Date of publication

November 06, 2026

Admiralty code

TA number

TA2026326

First seen

July 1, 2026

Targeted platforms

Windows

Threat actor

SlippyNunchucks

Malware

DarkVigil (also known as FDMTP)

Targeted regions

Hong Kong, Thailand, Japan, Vietnam, Oman, Sri Lanka

01 · Overview

Summary

SlippyNunchucks, a China-aligned espionage group, hijacked DNS resolution inside victim networks so that a routine update check from Sogou Input Method reached an attacker-controlled server instead of Tencent's. Because that request traveled over plain HTTP, the application accepted a forged configuration without question, pulled down two files, and loaded the DarkVigil implant through its own component routine.

There was no exploit, no phishing, and nothing for the victim to click, since simply typing in Chinese was enough to trigger the chain. DarkVigil (also known as FDMTP) is a modular .NET backdoor that runs add-ons straight from the registry and reports to its operators over an encrypted custom protocol, giving the group lasting surveillance over both individuals and organizations. Tencent closed the underlying weakness, CVE-2026-120422, in version 16.10.

CVE	Name	Affected product
CVE-2026-120422	Sogou Input Method for Windows Insecure HTTP Configuration Retrieval Vulnerability	Sogou Input Method for Windows (versions prior to 16.10)

02 · Analysis

Attack Details

This attack did not start with an exploit or a phishing email. It started with a lie about where a server lives. Sogou Input Method, the Tencent-owned Chinese typing tool, has a helper program called SGTool.exe that checks in with Sogou's servers over plain HTTP. In victim networks, the DNS answer for one of those servers was changed, so the request went to the attacker's machine instead, hidden behind the lookalike domain. With no encryption in the way, the app had no way to tell it was talking to a stranger. It is not known where the DNS was altered, and a hacked router, a router implant, or something at the internet provider are all possible.

The fake server returned a config file scrambled with the same encryption as the real one, with the MD5 values edited so the app's own file check would pass. It told SGTool.exe to fetch two files: a properly signed Adobe program renamed to biz_helper.exe, and a malicious libcef.dll carrying DarkVigil. Where those files land is the clever part. In one version, the Adobe program overwrites SogouComMgr.exe in the Components folder; in the other, the pair goes into a numbered biz_center folder. Either way, Sogou's own routine runs the attacker's binary, which side-loads the DLL, so no startup key or scheduled task is needed.

DarkVigil is a spying tool that grows inside the host it already owns, a .NET program built on the Vigil framework with more than twenty add-ons. The server pushes an add-on down the same channel, stores it packed in the registry under HKCU\Software\Microsoft\IME<HWID>\pluginHash, then has the implant unpack and run it in memory. The HWID comes from a fixed mutex plus the username, computer name, and MAC address, so every infected machine gets its own registry spot and its own identity on the attacker's side.

For command and control, DarkVigil uses DMTP, a small binary protocol that can ride on TCP, UDP, HTTP, WebSocket, or named pipes, with every message opening with the letters "dm". After the handshake, the implant reports the victim's machine details; both sides can call each other's routines, and the add-ons send whatever they collect back over the same encrypted channel into a web panel named Vigil, reached through bootstrap servers such as blog.wangmengfun[.]top. Tencent was informed about the flaw on September 11, 2026; version 16.10 arrived on October 30 with HTTPS and certificate pinning, and CVE-2026-120422 followed.

03 · Response

Recommendations

01
Update Sogou Input Method to Version 16.10 or Later
Tencent released version 16.10 on October 30, 2026, which moves the vulnerable requests to HTTPS and enables certificate pinning. Any Windows endpoint still running an earlier build remains exposed to the same hijack, so treat this as the single highest-value fix and confirm the version on every machine rather than trusting auto-update.
02
Harden DNS Resolution and the Devices on the Path
Pin endpoints to approved resolvers, enable DNS over HTTPS or TLS where supported, block outbound port 53 to anything else, and audit router firmware, admin credentials, and configured DNS servers. The hijack point is still unidentified and may sit in a home router or upstream at the ISP, so this is the one control that addresses the actual mechanism.
03
Block and Retro-Hunt the Attacker Infrastructure
Deny sogou-cdn[.]com, dev.soft-png-cdn[.]com, blog.wangmengfun[.]top, update.mssproxy[.]net, img.fusfun[.]top and the 47.x Alibaba Cloud addresses, then search historical DNS and proxy logs for the same values to find hosts that were hit before the block landed.
04
Check Endpoints for the Planted Files
Verify whether SogouComMgr.exe in the Components folder carries an Adobe signature instead of Tencent's, look for libcef.dll and biz_helper.exe under Components and the versioned biz_center folders, and check HKCU\Software\Microsoft\IME<HWID>\pluginHash for oversized binary values. Any one of these means the host is compromised.
05
Rebuild Confirmed Infections and Rotate Credentials
DarkVigil runs with the user's privileges and collects data through its add-ons, so deleting the dropped files isn't enough. Reimage affected endpoints and reset any credentials, tokens, and session cookies they could reach.

04 · Evidence

Indicators of Compromise (IoCs)

Type	Value
SHA1	`8A60A8E90E1F5F08F28FE5A6DD57BD686C20DC233E16BA611782AF6E45576D390488D28FD676BADE`
Domains	`sogou-cdn[.]comdev[.]soft-png-cdn[.]comblog[.]wangmengfun[.]topupdate[.]mssproxy[.]netimg[.]fusfun[.]top`
IPv4	`47[.]239[.]250[.]10247[.]237[.]122[.]17547[.]236[.]254[.]15947[.]86[.]15[.]162`
Filename	`libcef.dllMicrosoft.VisualStudio.HostingProcess.Utilities.Sync.dll`

05 · Tradecraft

MITRE ATT&CK TTPs

Resource Development

T1583Acquire Infrastructure

T1583.001Domains

Initial Access

T1659Content Injection

Credential Access

T1557Adversary-in-the-Middle

Stealth

T1574Hijack Execution Flow

T1574.001DLL

T1036Masquerading

T1036.005Match Legitimate Resource Name or Location

T1027Obfuscated Files or Information

Defense Impairment

T1112Modify Registry

Discovery

T1082System Information Discovery

Command and Control

T1071Application Layer Protocol

T1071.001Web Protocols

T1105Ingress Tool Transfer

T1573Encrypted Channel

Exfiltration

T1041Exfiltration Over C2 Channel

06 · Sources

References & Patch Links

Patch link

https://pinyin.sogou.com/changelog.php

References

What Next?

At Hive Pro, it is our mission to detect the most likely threats to your organization and to help you prevent them from happening.

Book a Demo of HivePro