China-Aligned SlippyNunchucks Hijacks Sogou Input Method DNS Requests to Deploy DarkVigil (FDMTP) Backdoor (CVE-2026-120422)

Key facts for SlippyNunchucks DarkVigil backdoor

Detection coverage for SlippyNunchucks DarkVigil backdoor

As of 2026-11-04, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5237 across Splunk SPL, Microsoft KQL and Sigma, covering 25 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: SlippyNunchucks Sogou DNS Hijack — config.pinyin.sogou.com Resolving To DarkVigil Staging Infrastructure (CVE-2026-120422)

Behavior-first detection of the Sogou Input Method DNS hijack in TL-2026-5237 (CVE-2026-120422): the Sogou config host config.pinyin.sogou.com resolving to the attacker Alibaba Cloud IPs 47.239.250.102, 47.237.122.175, 47.236.254.159 or 47.86.15.162, or any lookup of sogou-cdn.com / dev.soft-png-cdn.com. This is the initial-access step that lets SGTool.exe fetch a malicious AES-256-CBC config and deploy the DarkVigil (FDMTP) backdoor.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1557, T1659
• Data sources: sysmon_eventcode_22_dns, microsoft_defender_for_endpoint_dnsqueryresponse
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" earliest=-24h EventCode=22 (QueryName="config.pinyin.sogou.com" OR QueryName="*sogou-cdn.com" OR QueryName="*soft-png-cdn.com")
| eval ioc_ip_hit=if(match(QueryResults,"(^|[^0-9.])(47\\.239\\.250\\.102|47\\.237\\.122\\.175|47\\.236\\.254\\.159|47\\.86\\.15\\.162)([^0-9.]|$)"),1,0)
| eval ioc_domain_hit=if(match(QueryName,"(?i)(sogou-cdn\\.com|soft-png-cdn\\.com)$"),1,0)
| where ioc_ip_hit=1 OR ioc_domain_hit=1
| stats count earliest(_time) as first_seen latest(_time) as last_seen values(QueryResults) as resolved_to values(Image) as querying_process by host, QueryName
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

let iocIPs = dynamic(["47.239.250.102","47.237.122.175","47.236.254.159","47.86.15.162"]);
let iocDomains = dynamic(["sogou-cdn.com","soft-png-cdn.com"]);
DeviceEvents
| where Timestamp > ago(24h)
| where ActionType == "DnsQueryResponse"
| extend DnsQueryString = tostring(parse_json(AdditionalFields).DnsQueryString), DnsIps = tostring(parse_json(AdditionalFields).IpAddresses)
| where DnsQueryString has_any (iocDomains) or (DnsQueryString =~ "config.pinyin.sogou.com" and DnsIps has_any (iocIPs))
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName, DnsQueryString, DnsIps

Sigma

title: Sogou Config Host DNS Resolution To SlippyNunchucks Infrastructure
id: 6f0c2a4e-1b7d-4c53-9e21-5d8a3f7b0a11
status: experimental
description: Detects DNS resolution of config.pinyin.sogou.com to known SlippyNunchucks Alibaba Cloud staging IPs, or any lookup of the attacker domains sogou-cdn.com and soft-png-cdn.com (CVE-2026-120422 DNS hijack delivering DarkVigil).
references:
    - https://www.welivesecurity.com/en/eset-research/slippynunchucks-hijacks-sogou-input-methods-brand-promotion-mechanism-to-distribute-malware/
    - https://thehackernews.com/2026/11/china-aligned-hackers-hijack-sogou.html
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-04
tags:
    - attack.credential-access
    - attack.t1557
    - attack.initial-access
    - attack.t1659
    - cve.2026.120422
logsource:
    category: dns_query
    product: windows
detection:
    selection_staging:
        QueryName|endswith:
            - 'sogou-cdn.com'
            - 'soft-png-cdn.com'
    selection_hijack:
        QueryName: 'config.pinyin.sogou.com'
        QueryResults|contains:
            - '47.239.250.102'
            - '47.237.122.175'
            - '47.236.254.159'
            - '47.86.15.162'
    condition: 1 of selection_*
falsepositives:
    - Security researchers or sandboxes resolving the published IOC domains
    - Threat-intel enrichment tooling that actively resolves IOC domains
level: high

Known false positives:

• Security researchers or sandboxes resolving the published IOC domains
• Threat-intel enrichment tooling that actively resolves IOC domains

Tuning notes: Requires Sysmon EventCode 22 in index=sysmon. To catch hijacks to new infrastructure, invert the logic: alert when QueryName=config.pinyin.sogou.com resolves to an address outside your allowlist of Sogou/Tencent ranges. Refresh the IOC IP list from the ThreadLinqs feed.

• 🔒 SGTool.exe Drops [indicator] Or [indicator] — Hijacked Brand Promotion Config · unlock with TL Creds
• 🔒 DarkVigil [indicator] Sideloaded By [indicator] Or SogouComMgr.exe · unlock with TL Creds
• 🔒 Sogou Component Host Process Beaconing To Non-Vendor Public Destinations · unlock with TL Creds
• 🔒 SGTool.exe Network Connection To SlippyNunchucks Staging Servers · unlock with TL Creds
• 🔒 DarkVigil Plugin Storage Under HKCU Microsoft IME pluginHash Registry Key · unlock with TL Creds
• 🔒 DNS Lookup Of DarkVigil Bootstrap Domains · unlock with TL Creds
• 🔒 SGTool.exe Spawning Adobe-Signed Binary — DarkVigil DLL Sideloading Chain · unlock with TL Creds
• 🔒 DarkVigil Bootstrap And Staging Infrastructure Connections With Beacon Interval · unlock with TL Creds

Indicators of compromise for SlippyNunchucks DarkVigil backdoor

As of 2026-11-04, Threadlinqs Intelligence tracks 25 indicators of compromise for TL-2026-5237.

Sample indicators (3 of 25)

• IP address: 47.239.250[.]102
• Domain: sogou-cdn[.]com
• File hash: 8A60A8E90E1F5F08F28FE5A6DD57BD686C20DC23

Defanged, TLP:CLEAR. Full set of 25 indicators: unlock with TL Creds.

How SlippyNunchucks DarkVigil backdoor works

ESET Research attributes a surveillance campaign to SlippyNunchucks, a China-aligned intrusion set active since 2023-09-15 that targets Chinese-speaking organizations and individuals in Asia and Europe. The campaign abuses Sogou Input Method for Windows (versions prior to 16.10), whose SGTool.exe component retrieves configuration over unencrypted HTTP (CVE-2026-120422, CWE-1428, CVSS 4.0 8.9). The component is run as 'SGTool.exe --appid=scdreg -update' and requests config.pinyin.sogou.com/api/brandScd/getBrandScd.php for the Startup Brand Support Program (brand vocabulary promotion), which normally returns a 'tree.png' sprout icon. The method used to hijack DNS is unknown (compromised routers or ISP-level interception are possible); victims' resolution of the Sogou backend host was redirected to attacker servers on Alibaba Cloud infrastructure (47.239.250.102 and 47.237.122.175 serving sogou-cdn.com).

The attacker server returns an AES-256-CBC encrypted configuration (key and IV embedded in .rdata of the Sogou component) with modified MD5 checksums and arbitrary download paths. The configuration instructs SGTool.exe to download two files: a legitimate Adobe Licensing WF Helper (SHA-1 79188C8DE2378B437D39E867475C5B4714A0D7C9) renamed biz_helper.exe, and the DarkVigil implant libcef.dll. Method 1 places the Adobe binary at \SogouInput\Components\SogouComMgr.exe so that later SGTool.exe component operations (-installdoall, -invoke, -remove) execute it and sideload libcef.dll. Method 2 places the payloads in a versioned \Components\biz_center\<version>\ directory, executed through 'SGTool.exe -invoke BizCenterComBundle BizCenterCom'. Both reuse existing Sogou workflows, so no dedicated persistence mechanism is required.

DarkVigil (aka FDMTP) is a modular .NET framework with 20+ plugins that communicates over DMTP (Duplex Message Transport Protocol): a binary protocol with a 2-byte 'dm' magic, 2-byte flag (0x0001 for TCP-DMTP), 4-byte length and payload. The client handshakes with the default token 'Dmtp' and a proposed ID of <internal_name>.<protocol_type>:<HWID>, sends victim profile via the ClientInfo RPC, and exposes PluginService and OptionService RPC services. Plugins are pushed over DMTP file transfer, stored compressed in the registry at HKCU\Software\Microsoft\IME\<HWID>\pluginHash, then decompressed and loaded into the .NET runtime (Plugin.Plugin.Run). Plugins relay C2 through the client via SendPluginMsg; a plugin named Pillager was observed. The sideloaded component names include the .NET implant Microsoft.VisualStudio.HostingProcess.Utilities.Sync.dll. Bootstrap servers observed include blog.wangmengfun.top, update.mssproxy.net, img.fusfun.top and 47.86.15.162.

The actor also abused other Chinese-language applications for DarkVigil delivery: QuickFox (supply-chain compromise; the actor reportedly pivoted three days after QuickFox released a clean version in August 2026), QingTalk, MiYunChat, SoftCam and tawk.to. Notable victims include a multinational gambling organization (Sri Lanka, Philippines, Hong Kong operations), an internet cafe in Dubai and a university student in Denmark; ESET assesses the targeting as consistent with Chinese law-enforcement interests in cross-border gambling and fraud. ESET found no tactical overlap with Mustang Panda despite earlier DarkVigil links and treats SlippyNunchucks as a distinct intrusion set. A separate Darktrace report documents earlier FDMTP activity (late September 2025 to April 2026) assessed with moderate confidence as Twill Typhoon-linked; that reporting is related but not confirmed to be the same operation. ESET reported the weakness to Tencent on 2026-09-11; Tencent acknowledged it on 2026-09-21 and released Sogou Input Method 16.10 (HTTPS migration with certificate pinning) at the end of October 2026. Note: The Hacker News gives 2026-10-29 for the release while ESET's disclosure timeline gives 2026-10-30. A previous, unrelated Sogou issue (CVE-2026-51990, UNC3569, GRAYRABBIT) was reported in September 2026 per The Hacker News.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1036.005 Match Legitimate Resource Name or Location; T1574.001 DLL

Command and Control

T1071.001 Web Protocols; T1573 Encrypted Channel

defense-impairment

T1112 Modify Registry

Initial Access

T1195.002 Compromise Software Supply Chain; T1659 Content Injection

Credential Access

T1557 Adversary-in-the-Middle

stealth

T1574.001 DLL

Remediation for SlippyNunchucks DarkVigil backdoor

Patches

• Sogou Input Method 16.10 (migrates to HTTPS with certificate pinning)

Immediate actions

• Update Sogou Input Method for Windows to version 16.10 or later
• Block and alert on DNS resolution of config.pinyin.sogou.com to non-Sogou/Tencent addresses, and on connections to 47.239.250.102, 47.237.122.175, 47.236.254.159 and 47.86.15.162
• Block sogou-cdn.com, dev.soft-png-cdn.com, blog.wangmengfun.top, update.mssproxy.net and img.fusfun.top at DNS and proxy
• Hunt for biz_helper.exe, SogouComMgr.exe or libcef.dll under Sogou component directories and for the HKCU\Software\Microsoft\IME\<HWID> registry key
• Isolate hosts where SGTool.exe spawned an Adobe-signed binary and reimage after triage

Workarounds

• Where patching is not possible, block outbound HTTP to config.pinyin.sogou.com or uninstall Sogou Input Method

Longer-term hardening

• Use trusted, validated DNS resolvers (DoT/DoH) and monitor for DNS tampering on routers and CPE
• Enforce HTTPS for software update and configuration traffic and restrict unmanaged third-party IME/utility software
• Deploy EDR rules for signed-binary DLL sideloading from user-writable application directories
• Audit other abused applications (QuickFox, QingTalk, MiYunChat, SoftCam, tawk.to) for DarkVigil indicators

Affected and fixed versions

• Tencent / Sogou — Sogou Input Method (Windows)
  Vulnerable versions: < 16.10
  Fixed in: 16.10

Timeline of SlippyNunchucks DarkVigil backdoor

• 2023-09-15 SlippyNunchucks activity first attributed by ESET to this date (actor active since).
• 2026-06-07 Staging domain locked-ioc-11 (locked-ioc-16, Alibaba US) first seen.
• 2026-07-01 ESET observes the start of the Sogou Input Method DNS-hijacking campaign delivering locked-ioc-22.
• 2026-07-08 locked-ioc-22 bootstrap domain locked-ioc-12 first seen.
• 2026-07-21 locked-ioc-19 hijack/staging servers locked-ioc-15 and locked-ioc-14 first seen.
• 2026-08-06 Bootstrap domains locked-ioc-13 and locked-ioc-17 first seen; actor pivots to locked-ioc-24 three days after its clean release (August 2026).
• 2026-08-08 Bootstrap server locked-ioc-20 (Alibaba Cloud HK) first seen.
• 2026-09-11 ESET reports the insecure-HTTP weakness to Tencent Security Response Center.
• 2026-09-21 Tencent acknowledges the issue.
• 2026-10-30 Tencent releases Sogou Input Method 16.10 with HTTPS and certificate pinning (The Hacker News reports 2026-10-29).
• 2026-11-04 ESET publishes analysis; CVE-2026-120422 published; The Hacker News reports the campaign.

Sources cited for SlippyNunchucks DarkVigil backdoor

• CVE-2026-120422: Reliance on HTTP instead of HTTPS in Sogou Input Method (OffSeq Radar) radar.offseq.com · Advisory · 2026-11-04
• SlippyNunchucks hijacks Sogou Input Method's brand promotion mechanism to distribute malware (ESET Research) ESET WeLiveSecurity · Research · 2026-11-04
• Sogou Pinyin changelog (version 16.10) pinyin.sogou.com · Vendor report · 2026-10-30
• Chinese APT Campaign Targets Entities with Updated FDMTP Backdoor (Darktrace) darktrace.com · Research · 2026-05-01
• China-Aligned Hackers Hijack Sogou Input Method DNS Requests to Deploy DarkVigil Backdoor (NetManageIT repost) blog.netmanageit.com · Blog · 2026-11-04
• China-Aligned Hackers Hijack Sogou Input Method DNS Requests to Deploy DarkVigil Backdoor The Hacker News · News · 2026-11-04

More in malware

• Multi-Stage Windows PowerShell Loader Chain Delivering Themida/UPX-Protected Native Payload (contis.exe) with In-Memory Cryptographic Reconstruction
• XLoader (FormBook) Infostealer Delivered via Fake Business Order Phishing, RAR/JScript/LuaJIT Chain with In-Memory Injection
• WardenStealer and Aoki (Aokigahara) Infostealers Steal ChatGPT, Claude, and Codex Tokens That Survive Password Resets
• AI-Generated Malware: Source-Code Indicators and Trends (HUMAN Security / VoidLink / PROMPTSTEAL)
• Fake-download campaign uses trojanized Inno Setup installers to deliver monetization payloads (WorldProxyPool, CharityEngine/BOINC, AW Manager)