# China-Aligned SlippyNunchucks Hijacks Sogou Input Method DNS Requests to Deploy DarkVigil (FDMTP) Backdoor (CVE-2026-120422)

> China-aligned actor SlippyNunchucks hijacked DNS resolution of Sogou Input Method for Windows, abusing the insecure-HTTP brand vocabulary promotion mechanism (SGTool.exe) to push a malicious configuration that drops the DarkVigil (aka FDMTP) backdoor via DLL sideloading. Observed since 2026-07-01 against Hong Kong, Thailand, Japan, Vietnam, Oman and Sri Lanka; reported by ESET (Anh Ho).

- **Published:** 2026-11-04T13:04:13Z
- **Last reviewed:** 2026-11-04T13:04:13Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5237
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5237.png
- **ID:** TL-2026-5237
- **Severity:** HIGH (CVSS 8.9)
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** SlippyNunchucks (China)
- **Detections:** 9 (1 shown free below) · **IOCs:** 25 (3 shown free below)
- **CVEs:** CVE-2026-120422

## Description

ESET Research attributes a surveillance campaign to SlippyNunchucks, a China-aligned intrusion set active since 2023-09-15 that targets Chinese-speaking organizations and individuals in Asia and Europe. The campaign abuses Sogou Input Method for Windows (versions prior to 16.10), whose SGTool.exe component retrieves configuration over unencrypted HTTP (CVE-2026-120422, CWE-1428, CVSS 4.0 8.9). The component is run as 'SGTool.exe --appid=scdreg -update' and requests config.pinyin.sogou.com/api/brandScd/getBrandScd.php for the Startup Brand Support Program (brand vocabulary promotion), which normally returns a 'tree.png' sprout icon. The method used to hijack DNS is unknown (compromised routers or ISP-level interception are possible); victims' resolution of the Sogou backend host was redirected to attacker servers on Alibaba Cloud infrastructure (47.239.250.102 and 47.237.122.175 serving sogou-cdn.com).

The attacker server returns an AES-256-CBC encrypted configuration (key and IV embedded in .rdata of the Sogou component) with modified MD5 checksums and arbitrary download paths. The configuration instructs SGTool.exe to download two files: a legitimate Adobe Licensing WF Helper (SHA-1 79188C8DE2378B437D39E867475C5B4714A0D7C9) renamed biz_helper.exe, and the DarkVigil implant libcef.dll. Method 1 places the Adobe binary at \SogouInput\Components\SogouComMgr.exe so that later SGTool.exe component operations (-installdoall, -invoke, -remove) execute it and sideload libcef.dll. Method 2 places the payloads in a versioned \Components\biz_center\<version>\ directory, executed through 'SGTool.exe -invoke BizCenterComBundle BizCenterCom'. Both reuse existing Sogou workflows, so no dedicated persistence mechanism is required.

DarkVigil (aka FDMTP) is a modular .NET framework with 20+ plugins that communicates over DMTP (Duplex Message Transport Protocol): a binary protocol with a 2-byte 'dm' magic, 2-byte flag (0x0001 for TCP-DMTP), 4-byte length and payload. The client handshakes with the default token 'Dmtp' and a proposed ID of <internal_name>.<protocol_type>:<HWID>, sends victim profile via the ClientInfo RPC, and exposes PluginService and OptionService RPC services. Plugins are pushed over DMTP file transfer, stored compressed in the registry at HKCU\Software\Microsoft\IME\<HWID>\pluginHash, then decompressed and loaded into the .NET runtime (Plugin.Plugin.Run). Plugins relay C2 through the client via SendPluginMsg; a plugin named Pillager was observed. The sideloaded component names include the .NET implant Microsoft.VisualStudio.HostingProcess.Utilities.Sync.dll. Bootstrap servers observed include blog.wangmengfun.top, update.mssproxy.net, img.fusfun.top and 47.86.15.162.

The actor also abused other Chinese-language applications for DarkVigil delivery: QuickFox (supply-chain compromise; the actor reportedly pivoted three days after QuickFox released a clean version in August 2026), QingTalk, MiYunChat, SoftCam and tawk.to. Notable victims include a multinational gambling organization (Sri Lanka, Philippines, Hong Kong operations), an internet cafe in Dubai and a university student in Denmark; ESET assesses the targeting as consistent with Chinese law-enforcement interests in cross-border gambling and fraud. ESET found no tactical overlap with Mustang Panda despite earlier DarkVigil links and treats SlippyNunchucks as a distinct intrusion set. A separate Darktrace report documents earlier FDMTP activity (late September 2025 to April 2026) assessed with moderate confidence as Twill Typhoon-linked; that reporting is related but not confirmed to be the same operation. ESET reported the weakness to Tencent on 2026-09-11; Tencent acknowledged it on 2026-09-21 and released Sogou Input Method 16.10 (HTTPS migration with certificate pinning) at the end of October 2026. Note: The Hacker News gives 2026-10-29 for the release while ESET's disclosure timeline gives 2026-10-30. A previous, unrelated Sogou issue (CVE-2026-51990, UNC3569, GRAYRABBIT) was reported in September 2026 per The Hacker News.

## MITRE ATT&CK

- T1659 Content Injection
- T1195.002 Compromise Software Supply Chain
- T1557 Adversary-in-the-Middle
- T1574.001 DLL
- T1574.001 DLL
- T1036.005 Match Legitimate Resource Name or Location
- T1112 Modify Registry
- T1071.001 Web Protocols
- T1573 Encrypted Channel

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**SlippyNunchucks Sogou DNS Hijack — config.pinyin.sogou.com Resolving To DarkVigil Staging Infrastructure (CVE-2026-120422)** (`TL-2026-5237-SPL-001`)

Behavior-first detection of the Sogou Input Method DNS hijack in TL-2026-5237 (CVE-2026-120422): the Sogou config host config.pinyin.sogou.com resolving to the attacker Alibaba Cloud IPs 47.239.250.102, 47.237.122.175, 47.236.254.159 or 47.86.15.162, or any lookup of sogou-cdn.com / dev.soft-png-cdn.com. This is the initial-access step that lets SGTool.exe fetch a malicious AES-256-CBC config and deploy the DarkVigil (FDMTP) backdoor.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1557, T1659
- **Data sources:** sysmon_eventcode_22_dns, microsoft_defender_for_endpoint_dnsqueryresponse
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" earliest=-24h EventCode=22 (QueryName="config.pinyin.sogou.com" OR QueryName="*sogou-cdn.com" OR QueryName="*soft-png-cdn.com")
| eval ioc_ip_hit=if(match(QueryResults,"(^|[^0-9.])(47\\.239\\.250\\.102|47\\.237\\.122\\.175|47\\.236\\.254\\.159|47\\.86\\.15\\.162)([^0-9.]|$)"),1,0)
| eval ioc_domain_hit=if(match(QueryName,"(?i)(sogou-cdn\\.com|soft-png-cdn\\.com)$"),1,0)
| where ioc_ip_hit=1 OR ioc_domain_hit=1
| stats count earliest(_time) as first_seen latest(_time) as last_seen values(QueryResults) as resolved_to values(Image) as querying_process by host, QueryName
| convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
let iocIPs = dynamic(["47.239.250.102","47.237.122.175","47.236.254.159","47.86.15.162"]);
let iocDomains = dynamic(["sogou-cdn.com","soft-png-cdn.com"]);
DeviceEvents
| where Timestamp > ago(24h)
| where ActionType == "DnsQueryResponse"
| extend DnsQueryString = tostring(parse_json(AdditionalFields).DnsQueryString), DnsIps = tostring(parse_json(AdditionalFields).IpAddresses)
| where DnsQueryString has_any (iocDomains) or (DnsQueryString =~ "config.pinyin.sogou.com" and DnsIps has_any (iocIPs))
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName, DnsQueryString, DnsIps
```

### Sigma

```yaml
title: Sogou Config Host DNS Resolution To SlippyNunchucks Infrastructure
id: 6f0c2a4e-1b7d-4c53-9e21-5d8a3f7b0a11
status: experimental
description: Detects DNS resolution of config.pinyin.sogou.com to known SlippyNunchucks Alibaba Cloud staging IPs, or any lookup of the attacker domains sogou-cdn.com and soft-png-cdn.com (CVE-2026-120422 DNS hijack delivering DarkVigil).
references:
    - https://www.welivesecurity.com/en/eset-research/slippynunchucks-hijacks-sogou-input-methods-brand-promotion-mechanism-to-distribute-malware/
    - https://thehackernews.com/2026/11/china-aligned-hackers-hijack-sogou.html
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-04
tags:
    - attack.credential-access
    - attack.t1557
    - attack.initial-access
    - attack.t1659
    - cve.2026.120422
logsource:
    category: dns_query
    product: windows
detection:
    selection_staging:
        QueryName|endswith:
            - 'sogou-cdn.com'
            - 'soft-png-cdn.com'
    selection_hijack:
        QueryName: 'config.pinyin.sogou.com'
        QueryResults|contains:
            - '47.239.250.102'
            - '47.237.122.175'
            - '47.236.254.159'
            - '47.86.15.162'
    condition: 1 of selection_*
falsepositives:
    - Security researchers or sandboxes resolving the published IOC domains
    - Threat-intel enrichment tooling that actively resolves IOC domains
level: high

```

**Known false positives:**

- Security researchers or sandboxes resolving the published IOC domains
- Threat-intel enrichment tooling that actively resolves IOC domains

**Tuning notes:** Requires Sysmon EventCode 22 in index=sysmon. To catch hijacks to new infrastructure, invert the logic: alert when QueryName=config.pinyin.sogou.com resolves to an address outside your allowlist of Sogou/Tencent ranges. Refresh the IOC IP list from the ThreadLinqs feed.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- SGTool.exe Drops [indicator] Or [indicator] — Hijacked Brand Promotion Config (locked: unlock with TL Creds)
- DarkVigil [indicator] Sideloaded By [indicator] Or SogouComMgr.exe (locked: unlock with TL Creds)
- Sogou Component Host Process Beaconing To Non-Vendor Public Destinations (locked: unlock with TL Creds)
- SGTool.exe Network Connection To SlippyNunchucks Staging Servers (locked: unlock with TL Creds)
- DarkVigil Plugin Storage Under HKCU Microsoft IME pluginHash Registry Key (locked: unlock with TL Creds)
- DNS Lookup Of DarkVigil Bootstrap Domains (locked: unlock with TL Creds)
- SGTool.exe Spawning Adobe-Signed Binary — DarkVigil DLL Sideloading Chain (locked: unlock with TL Creds)
- DarkVigil Bootstrap And Staging Infrastructure Connections With Beacon Interval (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 25)

Defanged, TLP:CLEAR.

- IP address: `47.239.250[.]102`
- Domain: `sogou-cdn[.]com`
- File hash: `8A60A8E90E1F5F08F28FE5A6DD57BD686C20DC23`

Full set of 25 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [China-Aligned Hackers Hijack Sogou Input Method DNS Requests to Deploy DarkVigil Backdoor](https://thehackernews.com/2026/11/china-aligned-hackers-hijack-sogou.html)
- [SlippyNunchucks hijacks Sogou Input Method's brand promotion mechanism to distribute malware (ESET Research)](https://www.welivesecurity.com/en/eset-research/slippynunchucks-hijacks-sogou-input-methods-brand-promotion-mechanism-to-distribute-malware/)
- [CVE-2026-120422: Reliance on HTTP instead of HTTPS in Sogou Input Method (OffSeq Radar)](https://radar.offseq.com/threat/cve-2026-120422-cwe-1428-reliance-on-http-instead-of-https-in-sogou-sogou-input-method-e5cb34eadbc44f5e)
- [Sogou Pinyin changelog (version 16.10)](https://pinyin.sogou.com/changelog.php)
- [Chinese APT Campaign Targets Entities with Updated FDMTP Backdoor (Darktrace)](https://www.darktrace.com/blog/chinese-apt-campaign-targets-entities-with-updated-fdmtp-backdoor)
- [China-Aligned Hackers Hijack Sogou Input Method DNS Requests to Deploy DarkVigil Backdoor (NetManageIT repost)](https://blog.netmanageit.com/china-aligned-hackers-hijack-sogou-input-method-dns-requests-to-deploy-darkvigil-backdoor/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5237