{"id":3974,"date":"2026-11-04T16:25:29","date_gmt":"2026-11-04T16:25:29","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=3974"},"modified":"2026-11-04T16:25:29","modified_gmt":"2026-11-04T16:25:29","slug":"china-aligned-hackers-hijack-sogou-input-method-dns-requests-to-deploy-darkvigil-backdoor","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=3974","title":{"rendered":"China-Aligned Hackers Hijack Sogou Input Method DNS Requests to Deploy DarkVigil Backdoor"},"content":{"rendered":"
\n
<\/a><\/div>\n

A China-aligned threat actor known as SlippyNunchucks<\/strong> has been attributed to a Domain Name System (DNS) hijacking operation abusing insecure HTTP communications in Windows versions of Sogou Input Method as part of a surveillance campaign designed to deploy an implant called DarkVigil (aka FDMTP).<\/p>\n

The campaign, observed starting July 1, 2026, is assessed to have targeted organizations and Chinese-speaking individuals in Hong Kong, Thailand, Japan, Vietnam, Oman, and Sri Lanka, according to ESET.<\/p>\n

\u00abDarkVigil implants are typically deployed through popular Chinese applications,\u00bb ESET researcher Anh Ho said<\/a> in a report shared with The Hacker News. \u00abBy abusing these applications, the SlippyNunchucks threat actor has been able to reach Chinese-speaking users across Asia and Europe.\u00bb<\/p>\n

Some of the applications abused by the adversary include Sogou Input Method, QuickFox, QingTalk, MiYunChat, SoftCam, and tawk.to.<\/p>\n

Active since at least September 15, 2023, SlippyNunchucks is known for targeting organizations and Chinese-speaking individuals across South and East Asia. These attacks led to the deployment of a modular .NET framework that includes DarkVigil and a set of over 20 plugins.<\/p>\n

Although the use of the backdoor has been previously linked to Mustang Panda, ESET said it found no tactical overlaps between the threat actor and DarkVigil-related activity in its telemetry, prompting it to classify it as a distinct intrusion set.<\/p>\n

Earlier this August, Fortinet’s FortiGuard Incident Response Team detailed the threat actor’s supply chain compromise of the QuickFox VPN and network acceleration tool to deliver DarkVigil.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

According to the Slovakian cybersecurity company, the adversary shifted to exploiting Sogou Input Method, a popular Chinese-language input method editor developed by Tencent, as a delivery vector three days after QuickFox released a clean version of its program.<\/p>\n

<\/p>\n

Specifically, the attack involves hijacking the app’s branded vocabulary promotion mechanism to serve a malicious configuration, which ultimately paves the way for the deployment of the malware via SGTool.exe, a legitimate Sogou Input Method component that functions as a multi-purpose task dispatcher.<\/p>\n

In a clean environment, the executable sends an HTTP request to the \u00abconfig.pinyin.sogou[.]com\/api\/brandScd\/getBrandScd.php\u00bb endpoint to fetch a configuration. But in the attack discovered by ESET, the DNS resolution of the domain is tampered with to resolve it to one of the two staging servers –<\/p>\n

\"\"<\/a><\/div>\n

The consequence of this DNS hijacking was that HTTP requests to the \u00abgetBrandScd.php\u00bb endpoint were routed to one of the staging servers, which then responded with a malicious configuration. The configuration, for its part, instructs the binary to download two additional payloads from \u00absogou-cdn[.]com\u00bb and launch the malware via DLL sideloading –<\/p>\n