Tencent fixes Sogou Input Method flaw exploited for DarkVigil
China-aligned threat actor SlippyNunchucks hijacked Domain Name System requests made by Windows versions of Tencent’s Sogou Input Method to deliver the DarkVigil backdoor, ESET reported. The campaign was observed from July 1, 2026 and targeted organizations and Chinese-speaking individuals in Hong Kong, Thailand, Japan, Vietnam, Oman and Sri Lanka.
Tencent addressed the issue, tracked as CVE-2026-120422, in Sogou Input Method version 16.10, released on October 29, 2026. The fix changes the affected configuration requests from HTTP to HTTPS, removing the insecure transport condition used in the operation.
DNS redirection turned a legitimate feature into a delivery path
The intrusion abused Sogou Input Method’s branded vocabulary promotion mechanism. In normal operation, the legitimate component SGTool.exe, a multi-purpose task dispatcher, sends an HTTP request to the config.pinyin.sogou[.]com/api/brandScd/getBrandScd.php endpoint to retrieve a configuration file.
ESET found that attackers tampered with DNS resolution for that domain, redirecting the request to one of two staging servers: 47.239.250[.]102, associated with sogou-cdn[.]com, or 47.237.122[.]175, associated with dev.soft-png-cdn.com. Because the request used HTTP, the redirected server could return a malicious configuration in place of the expected one.
That configuration instructed SGTool.exe to download two further payloads from sogou-cdn[.]com: a legitimate Adobe executable named biz_helper.exe and a rogue libcef.dll containing DarkVigil. The malware was then launched through DLL sideloading, using the legitimate executable to load the malicious library.
DarkVigil campaign follows earlier QuickFox compromise
DarkVigil, also known as FDMTP, is a modular .NET framework with more than 20 plugins. It uses the Duplex Message Transport Protocol, or DMTP, for command and control, enabling an operator-controlled server to deliver and orchestrate plugins used for persistence or data collection.
ESET said SlippyNunchucks has operated since at least September 15, 2023 and has targeted organizations and Chinese-speaking individuals across South and East Asia. Although DarkVigil had previously been linked to Mustang Panda, ESET found no tactical overlap in its telemetry and treats SlippyNunchucks as a separate intrusion set.
The group had also compromised the QuickFox VPN and network acceleration tool to distribute DarkVigil, as detailed by Fortinet’s FortiGuard Incident Response Team in August. ESET said the actors moved to Sogou Input Method three days after QuickFox released a clean version of its software, illustrating how attackers can shift delivery vectors after a compromised application is remediated.
What organizations should check
The reported targeting included a Chinese-language online betting platform operator active in Sri Lanka, Hong Kong and the Philippines. ESET characterized the activity as a nation-state surveillance effort and noted the relevance of China’s restrictions on gambling businesses and organizing Chinese citizens to gamble abroad.
Organizations using Sogou Input Method should identify affected Windows installations and confirm they run version 16.10 or later. Security teams can also review DNS resolution for config.pinyin.sogou[.]com, network connections to the identified staging infrastructure, and endpoint activity involving SGTool.exe, biz_helper.exe and libcef.dll. The practical priority is to apply the available update and investigate signs that an insecure configuration request was redirected before the fix was deployed.