A China-aligned espionage group has been turning a popular Chinese keyboard app into its own delivery channel, poisoning DNS answers so that an unencrypted settings request returns a booby-trapped configuration. ESET’s findings show how one forgotten HTTP call in trusted software can cancel out much endpoint hardening.
What happened
On 4 November 2026 ESET Research published an analysis of a campaign by a group it calls SlippyNunchucks, which it has followed since 2025 and believes has been operating since at least September 2023. Starting on 1 July 2026, ESET’s telemetry showed the group’s DarkVigil backdoor (also tracked as FDMTP) being launched by SGTool.exe, a legitimate component of the Windows edition of Sogou Input Method. Sogou is one of the most widely used input method editors for typing Chinese characters, and Tencent has owned it since 2021.
ESET says the switch to Sogou came three days after QuickFox, a VPN tool the group had earlier compromised through its supply chain, shipped a clean release.
Victims seen in this wave were in Japan, Vietnam, Thailand, Hong Kong, Sri Lanka and Oman, covering organisations and Chinese-speaking individuals. Across its wider history, ESET notes, the group has occasionally gone after people in Europe, the UK included, alongside Germany, Austria and Russia. ESET reported the weakness to Tencent on 11 September, Tencent acknowledged it ten days later, and Sogou version 16.10, released at the end of October, moved the affected traffic to HTTPS with certificate pinning. The Hacker News cites CVE-2026-120422, an identifier absent from ESET’s published timeline.
ESET assesses with high confidence that SlippyNunchucks serves a nation-state surveillance effort aligned with Beijing. It cites sustained monitoring of a firm running Chinese-language betting sites, which ESET links to China’s criminal penalties for running gambling businesses and organising citizens to gamble abroad. Earlier public reporting linked DarkVigil to Mustang Panda, but ESET says its data shows no overlap and it tracks the group separately.
The technical picture
The abused feature is mundane: a brand promotion scheme that shows startup names in the suggestion list beside a small sprout icon. To fetch it, SGTool.exe asks a Sogou back-end host for an encrypted configuration file. ESET counted 20 endpoints on that host which the client contacted over plain HTTP, even though the server itself supports TLS with a valid Tencent certificate.
On victim networks, the attacker controlled what that hostname resolved to, pointing it at staging servers behind a lookalike domain, sogou-cdn[.]com. Those servers returned a configuration encrypted the same way as the genuine one, but listing two different downloads: a legitimate, signed Adobe licensing helper renamed to look like a Sogou business component, and a malicious libcef.dll. Because the attacker also supplied the hash values the client checks, the integrity test passed. The config also chose save locations that Sogou’s own component manager would later execute. The signed Adobe binary then side-loads the DLL, and DarkVigil runs.
Two points stand out for anyone who does offensive work. First, there is no memory corruption here. ESET describes the root cause as insecure HTTP rather than an exploit, and the client trusted an integrity value delivered over the same unauthenticated channel as the payload. Second, persistence came free: riding existing component workflows avoided creating scheduled tasks or run keys that detection rules are tuned to spot.
DarkVigil itself is written in .NET and is modular, with over 20 known plugins, built on an internal framework named Vigil. Command and control uses DMTP, a protocol from the open-source TouchSocket networking library, with plugins cached in the registry under an IME-themed key. What ESET could not establish is where the DNS tampering happens. Its candidates are maliciously configured or implanted routers, or interception at ISP level. Infosecurity Magazine also reports ESET’s observation that the downloader still neither validates file types nor restricts save locations, so the HTTPS change closes this path without fixing the underlying design.
Why it matters for UK organisations
Few UK firms run Sogou, but the lesson is wider: any application quietly fetching configuration over cleartext is an execution primitive for whoever controls the network path. That includes hotel and conference Wi-Fi, compromised home routers used by remote staff, and edge devices that state actors have repeatedly shown they can own.
There is also a direct population at risk. UK universities, law firms and financial services teams employ and serve many Chinese-speaking staff and students who run input method editors on their laptops. ESET’s mention of a university student in Denmark among past victims should resonate with UK higher education, where BYOD is the norm and endpoint visibility is limited.
Finally, the group’s abuse of several consumer apps (ESET lists QuickFox, QingTalk, MiYunChat, SoftCam and tawk.to alongside Sogou) shows a deliberate hunt for weak update channels in shadow IT.
Expert view
When we test corporate networks, cleartext update and telemetry traffic from desktop applications is one of the most reliable findings we report, and one of the least often fixed, because it rarely scores highly on a vulnerability scanner. This campaign is a textbook example of why that is a mistake.
The use of a signed Adobe helper to side-load the implant is equally familiar. Publisher-based allow-listing alone would have let it run. In my experience the controls that actually catch side-loading are the boring ones: alerting on signed binaries executing from unusual paths, and watching for DLLs with well-known names such as libcef.dll appearing outside their expected application directories.
I would also caution against reading the HTTPS fix as the end of the story. ESET is clear that the hijacking point is still unknown. If routers or upstream infrastructure are compromised, the same operator will look for the next application that phones home insecurely, as it did when QuickFox was cleaned up.
What to do now
- Inventory and update. Find any Sogou Input Method installs and move them to version 16.10 or later, or remove them where there is no business need. This sits squarely under the Cyber Essentials security update management control.
- Hunt for the indicators. Pull ESET’s IoCs from its GitHub repository and search DNS, proxy and EDR logs for sogou-cdn[.]com, the published staging IPs and the DarkVigil hashes.
- Look for side-loading. Query for libcef.dll or renamed Adobe licensing binaries running from input method or user profile directories, and for unexpected child processes of IME components.
- Audit cleartext application traffic. Use proxy or firewall logs to identify desktop software making plain HTTP requests for configuration or updates, and block or replace it. Map this to the Cyber Essentials secure configuration and firewall controls.
- Harden DNS for remote users. Force managed devices to use protected corporate resolvers over an always-on VPN or encrypted DNS, so a hostile router cannot rewrite answers.
- Tighten application control. Restrict which user-installable software is permitted, and treat consumer apps on BYOD devices accessing corporate data as untrusted, in line with the malware protection control.
Bottom line
SlippyNunchucks did not need a clever exploit, only a trusted app that fetched instructions without encryption and an ability to steer DNS. For UK defenders the takeaway is practical: find the cleartext update channels in your estate before a state-aligned operator does, and stop assuming a signed binary is a safe one.
Sources
- ESET WeLiveSecurity: SlippyNunchucks hijacks Sogou Input Method’s brand promotion mechanism to distribute malware
- The Hacker News: China-Aligned Hackers Hijack Sogou Input Method DNS Requests to Deploy DarkVigil Backdoor
- Infosecurity Magazine: China-Aligned Group Abuses Sogou Input Method to Deliver Malware
