SlippyNunchucks Hijacks Sogou Input Method Lookups to Deliver DarkVigil: The Attack Chain Step by Step

ESET Research reported on 4 November 2026 that a China-aligned group it calls SlippyNunchucks abused Sogou Input Method for Windows to deliver the DarkVigil implant, also known as FDMTP. The delivery started on 1 July 2026 and used unencrypted HTTP requests made by a Sogou helper program.

The attack did not need a memory corruption bug in the input method. Someone controlling the DNS answer for Sogou’s configuration host could hand the helper a malicious configuration, and the helper then downloaded and ran the attacker’s files. ESET says the point where the DNS manipulation happens is still unknown.

Who Is SlippyNunchucks and What Is DarkVigil?

ESET has tracked the DarkVigil toolset and its operator since early 2025 and dates the group’s activity back to at least 15 September 2023. The name DarkVigil comes from an internal framework called Vigil, which ESET saw in .NET library references and debug paths. A web admin panel with the Vigil logo manages the data the implants collect.

According to ESET, DarkVigil is typically deployed through popular Chinese applications. Besides Sogou Input Method, ESET lists QuickFox (a supply chain compromise), QingTalk, MiYunChat, SoftCam and tawk.to as software the group has abused since 2025. The victims ESET describes include organisations and Chinese-speaking individuals across South and East Asia, with occasional targets in Europe.

How Does a Brand Promotion Feature Become a Download Channel?

Sogou Input Method is a widely used Chinese input method, launched in 2006 and owned by Tencent since 2021. It supports cell dictionaries that add vocabulary. Under a 2016 Startup Brand Support Program, startups could place brand names in the candidate lists, marked with a green sprout icon.

The hijacked request fetches the configuration that tells Sogou which icons to download for those branded dictionaries. ESET found 20 request endpoints on the official configuration host that SGTool.exe reached over plain HTTP, including a brand dictionary endpoint. Plain HTTP gave the attacker both the chance to answer and nothing that proved the answer was genuine.

The sequence follows ESET’s step by step description. The configuration is encrypted the same way as genuine responses, with a key and initialisation vector stored in the SGTool.exe data section. The attacker also sets the hash fields to match its own payloads, so the integrity values in the configuration agree with the files.

What Does the Malicious Configuration Tell the Installer to Do?

The configuration names two downloads. One is a legitimate, signed Adobe Licensing WF Helper that ESET says is renamed biz_helper.exe. The other is the DarkVigil implant, a file called libcef.dll that the Adobe helper loads by DLL side-loading. The icon fields in the configuration set the destination paths.

ESET describes two ways the paths lead to execution, and only one works at a time. In the first, the Adobe binary replaces SogouComMgr.exe, so every component command that Sogou runs starts the attacker’s helper and loads the implant, which also gives persistence. In the second, the files go under the biz_center component folder and run when SGTool.exe invokes the BizCenterCom bundle.

ESET notes that both methods are highly destructive and likely to cause software failures. For a defender that is a useful clue: a Sogou component that suddenly crashes or reinstalls itself may be the visible side effect.

What Can DarkVigil Do After It Loads?

DarkVigil is a modular .NET toolset with more than 20 plugins, built on the Vigil framework and the TouchSocket networking library. ESET names two implant forms: libcef.dll (detected as Win64/Agent.KSV) and a .NET implant (MSIL/DarkVigil_AGen.D). The command channel uses the Duplex Message Transport Protocol, DMTP, which can run over TCP, UDP, HTTP, WebSocket and named pipes.

The server pushes a plugin through DMTP file transfer. The implant stores the compressed plugin in the registry under HKCU\Software\Microsoft\IME\ followed by a hardware identifier, then runs it. Plugins reach the command server through the implant, and ESET gives one example called Pillager. Packets use four fields: a two byte “dm” magic value, a two byte flag, a four byte length and the data.

Initial contact uses HTTP based bootstrap domains and servers. The implant sends a victim profile, and ESET says DarkVigil can use DMTP to exfiltrate data to its command server.

Who Is Behind It, and Why Does ESET Reject the Mustang Panda Link?

ESET assesses with high confidence that SlippyNunchucks is associated with a nation-state surveillance effort aligned with Chinese government interests. Part of the reasoning is victimology, including an online betting operation, which ESET calls notable given China’s restrictions on gambling. ESET links this to Chinese efforts against Southeast Asian scam industries.

Other public reporting attributes DarkVigil to Mustang Panda, also called Twill Typhoon. ESET writes that its telemetry has not revealed any overlaps with that group. Our Mustang Panda profile covers the actor that others have linked to FDMTP.

What Do the CVE Record and the Fix Say?

ESET is the CNA for CVE-2026-120422. The NVD record, published on 4 November 2026, says SGTool.exe retrieves configuration data over unencrypted HTTP, so an attacker who can manipulate network traffic can replace the server response. The attacker can then make SGTool.exe download files to arbitrary locations, including paths used by legitimate components, which can lead to code execution.

The record carries a CVSS 4.0 base score of 8.9 (High) from ESET, with a network attack vector, low attack complexity, attack requirements marked present and user interaction marked passive. It lists no CVSS 3.1 score, and the CVE is not in CISA KEV as of 4 November 2026. ESET says version 16.10 moves the requests to HTTPS, enforces TLS certificate validation and adds certificate pinning.

The record does not list a vulnerable version range, and the article implies versions before 16.10. We read that as: treat every Windows build older than 16.10 as exposed.

Which Telemetry Follows the Attack Chain?

ESET lists these ATT&CK techniques for the chain: adversary in the middle (T1557), content injection (T1659), DLL hijacking (T1574.001) and masquerading (T1036.005). It adds registry modification (T1112), ingress tool transfer (T1105), encrypted channel (T1573) and exfiltration over the command channel (T1041). Detection follows the same order.

1. DNS: compare what resolvers return for Sogou’s configuration host with the authoritative answer, and flag answers that point to hosting you do not expect.
2. Network and process: look for SGTool.exe started with the arguments ESET lists, --appid=scdreg -update. Then check for cleartext HTTP requests to the Sogou configuration host, followed by two file downloads.
3. Endpoint files: a signed Adobe Licensing WF Helper under the Sogou Components path, or a SogouComMgr.exe that is really an Adobe binary, or a libcef.dll beside it.
4. Registry: values under HKCU\Software\Microsoft\IME\ keyed by a hardware identifier, which ESET says hold the plugin hash.
5. Process behaviour: an Adobe signed binary loading an unsigned libcef.dll from a Sogou folder, and persistent outbound sessions with the “dm” packet header.

These checks restate ESET’s technical details. The order and the idea of comparing resolver answers are our advice. ESET publishes hashes, hijacking and staging servers and bootstrap domains in its public indicator repository, so load those into your tooling from there.

What Should Defenders Do First?

Inventory Windows machines that run Sogou Input Method and update them to 16.10 or later, as ESET states the fix. Most of the named targets sit in Hong Kong, Thailand, Japan, Vietnam, Sri Lanka and Oman, so prioritise offices and staff in those places. Where Sogou is not allowed, remove it and check the Components folder for leftovers.

Because the DNS manipulation point is unknown, treat resolvers and routers on affected sites as part of the incident. We recommend DNS over a resolver you control, logging of DNS answers, and blocking cleartext HTTP from input method helpers where policy allows. For a machine that matches the file or registry indicators above, isolate it and treat the user’s credentials and files as exposed. Our guide on DLL hijacking explains the side-loading step defenders should expect.

What Does ESET Leave Open?

ESET states that the point at which DNS manipulation occurs remains unknown, and that the earliest activity date is “at least” 2023. Its text gives two dates for the Tencent fix: the body says version 16.10 was released on 29 October, while the disclosure timeline says 30 October. We show 29 October in the timeline above and flag the 30 October entry.

ESET lists three suspected routes for the DNS manipulation without confirming any. They are routers with modified DNS settings, routers carrying an implant that hijacks DNS requests, or interception at the ISP level. It adds that the volume of compromises and their geographic spread first suggested an exploit.

What would change our view: a statement from Tencent about affected builds, or ESET naming the network position behind the DNS answers. We will update this analysis if either is published.