China-Aligned Hackers Hijack Sogou Input Method DNS Requests to Deploy DarkVigil Backdoor

A China-aligned group tracked as SlippyNunchucks has been tampering with DNS resolution for Sogou Input Method on Windows, exploiting the fact that the app's branded-vocabulary update feature communicated over plain HTTP. By redirecting the relevant lookups to attacker-controlled servers, the actor served a poisoned configuration that caused the legitimate SGTool.exe component to fetch a trojanized DLL (libcef.dll) via sideloading alongside a genuine Adobe executable, ultimately installing a modular backdoor called DarkVigil (also known as FDMTP), which uses its own Duplex Message Transport Protocol for C2 and supports over 20 plugins. ESET says the campaign, active since July 2026, has hit organizations and Chinese-speaking users in Hong Kong, Thailand, Japan, Vietnam, Oman and Sri Lanka, including firms running Chinese-language betting platforms—a notable target given Beijing's gambling restrictions. The group has previously abused other popular Chinese software such as QuickFox, QingTalk, MiYunChat, SoftCam and tawk.to to spread the same implant. Tencent fixed the underlying flaw, tracked as CVE-2026-120422, by moving the affected requests to HTTPS in Sogou Input Method version 16.10, released October 29, 2026.