Adversary Intelligence — 2026-11-11

ESET Reports China-Aligned SlippyNunchucks Espionage Group Hijacked Sogou Input Method Updates via DNS Poisoning to Deploy DarkVigil Malware Across Multiple Countries

BLUFSlippyNunchucks' abuse of Sogou's plaintext HTTP calls demonstrates a repeatable supply-chain technique that any application fetching configuration over unencrypted channels remains vulnerable to, and the unidentified DNS hijack mechanism means the underlying network access persists after patching.

ESET Research reported that the China-aligned SlippyNunchucks group hijacked DNS resolution for config.pinyin.sogou[.]com, redirecting Sogou Input Method's unencrypted HTTP brand-promotion request to attacker servers that returned a malicious configuration 1. That configuration made SGTool.exe place a renamed Adobe binary and the DarkVigil implant libcef.dll where Sogou's own component workflows would execute them 1. ESET telemetry showed victims in Hong Kong, Thailand, Japan, Vietnam, Oman, and Sri Lanka beginning July 1 12; The Hacker News repeated the July 1 start date 3. ESET said the point of DNS manipulation remains unknown 1. Tencent released version 16.10 on October 30, moving the requests to HTTPS, and ESET's CNA issued CVE-2026-120422 12. ESET also said its telemetry shows no overlap with Mustang Panda, which some public reporting links to DarkVigil 2.

Analysis
Sogou's plaintext HTTP calls turned a trusted input method into a DarkVigil delivery channel, and Tencent's fix closes only one of 20 unencrypted endpoints on that host. Users in the affected countries have been exposed since July 1, so organizations with Chinese-speaking staff abroad should hunt for a renamed Adobe binary at SogouComMgr.exe and a libcef.dll under Sogou component paths. Because the point of DNS manipulation remains unknown, patching Sogou does not remove the underlying access, and the group has already moved between QuickFox and Sogou, so other applications fetching configuration over HTTP could be abused the same way. The operation may instead be ISP-level or state-positioned interception in the affected countries, with Sogou incidental. Confidence is high because two primary ESET releases agree on victim countries, dates, and the fix, but the reporting traces to one vendor investigation and the hijack vector remains a gap.

4 sources

SlippyNunchucks hijacks Sogou Input Method’s brand promotion mechanism to distribute malware - ESET Research (WeLiveSecurity)
China-aligned SlippyNunchucks threat group hijacks language app to distribute malware abroad, ESET Research discovers
China-Aligned Hackers Hijack Sogou Input Method DNS Requests to Deploy DarkVigil Backdoor - The Hacker News
9th November Threat Intelligence Report - Check Point Research