SlippyNunchucks hijacks Sogou Input Method’s brand promotion mechanism to distribute malware

SlippyNunchucks, a China-aligned threat actor, has been tracking the DarkVigil toolset since 2025, which involves a modular .NET toolset known as FDMTP and a Vigil malware framework utilizing TouchSocket networking. The threat actor deployed DarkVigil implants by abusing popular Chinese applications like Sogou Input Method, QuickFox, and others to reach users in Asia and Europe. A specific attack vector involved abusing the Sogou Input Method’s insecure HTTP communications to hijack DNS resolution, which facilitated the deployment of malicious configurations. This process targeted organizations and Chinese-speaking individuals across regions including Hong Kong, Thailand, Japan, Vietnam, Oman, and Sri Lanka.
The mechanism involves hijacking the application's brand promotion mechanism within Sogou Input Method to retrieve configuration data. This data instructed a component (SGTool.exe) to download payloads, specifically renaming a legitimate Adobe binary to implant it as a Sogou Input Method component. This allowed the implants to execute through existing component management workflows like SogouComMgr.exe, achieving persistence without separate mechanisms. DarkVigil utilizes the Duplex Message Transport Protocol (DMTP) for Command and Control (C&C) communication, employing reverse remote procedure calls (RPC) and dual server-client/client-client channels for orchestration. Tencent released an update addressing the vulnerability in version 16.10 by migrating HTTP requests to HTTPS.

* ESET has tracked the DarkVigil toolset and its operator, SlippyNunchucks, since 2025.
* DarkVigil is a modular .NET toolset built on the Vigil malware framework, which uses TouchSocket networking and DMTP for C&C communications.
* SlippyNunchucks has abused Chinese applications, including Sogou Input Method, QuickFox, QingTalk, MiYunChat, SoftCam, and tawk.to to deploy DarkVigil implants.
* The activity targeted organizations and Chinese-speaking individuals in Hong Kong, Thailand, Japan, Vietnam, Oman, and Sri Lanka.
* A DNS hijacking operation was observed abusing Sogou Input Method’s insecure HTTP communications.
* The attack involved hijacking a request from the application’s brand promotion mechanism to serve a malicious configuration for payload placement.
* Sogou Input Method uses cell dictionaries for vocabulary expansion via the Startup Brand Support Program.
* SGTool.exe was observed sending an HTTP request to config.pinyin.sogou[.]com to retrieve configuration data.
* The malicious configuration instructed SGTool.exe to download payloads, including bizhelper.exe and libcef.dll, to specified locations.
* Payload execution was achieved by disguising the Adobe binary as a Sogou Input Method component, leveraging existing component management utilities like SogouComMgr.exe.
* DarkVigil C&C uses DMTP, which supports RPC mechanisms for command/response and simultaneous server-client/client-client communication.
* The vulnerability was disclosed on 2026-11-04 with CVE ID CVE-2026-120422.
* Indicators of Compromise include files like libcef.dll and network artifacts pointing to domains such as sogou-cdn[.]com.

The narrative describes a sophisticated, multi-layered attack that exploits a trust relationship within widely used Chinese software to achieve remote execution under the guise of legitimate application functionality. The pattern involves shifting from an initial access vulnerability (supply chain compromise) to lateral movement and persistence by manipulating application workflows. The mechanism demonstrates a specific type of social engineering layered onto technical exploitation: embedding malicious instructions within seemingly benign brand promotion requests. This is not simply exploiting a vulnerability; it is weaponizing the application's internal architecture—specifically, its component management routines—to execute arbitrary code.
The observation that the threat actor successfully leveraged existing workflows (like SogouInput\Components and SogouComMgr.exe) to achieve persistence is a critical pattern for understanding modern malware effectiveness. This reduces the operational friction for the attacker; they do not need to invent new persistence methods but hijack established, trusted routines. Furthermore, the use of DNS hijacking as an intermediary step highlights the strategy of exploiting lower-level network trust (DNS resolution) to mask or direct the flow of application-layer traffic, which is often less scrutinized than direct data exfiltration. The focus on targeting specific demographics and organizations linked to illicit activities suggests a pattern aligned with state-sponsored objectives related to regional control and economic pressure.
The reliance on DMTP for C&C communication reveals an architectural choice that prioritizes flexibility over simplicity, allowing the malware to adapt its communication method across various transport protocols. The complexity introduced by RPC mechanisms, where client and server functionalities are interwoven, suggests a design intended for resilient, stateful command structures rather than simple one-way data dumps. When analyzing these deep technical details alongside the operational context, the true implication is that successful security requires not just patching vulnerabilities but understanding and hardening the underlying application logic and inter-process communication channels themselves.
Bridge Questions:
If the reliance on specific Chinese software supply chains is a dominant access vector, what are the systemic risks to global digital infrastructure when these applications become the primary infection pathways? How can organizations establish trust boundaries around proprietary workflows like component management so that legitimate application functionality cannot be co-opted for malicious execution? What alternative methods exist for achieving remote payload delivery and persistence that do not rely on subverting established application APIs?