Sogou Input Method Exploited by SlippyNunchucks in Cyberespionage Campaign

A hacking group known as SlippyNunchucks has exploited the Sogou Input Method, a widely used Chinese keyboard software, to deploy a backdoor named DarkVigil on Windows systems across several Asian countries. The group targeted users in Hong Kong, Thailand, Japan, Vietnam, Sri Lanka, and Oman, leveraging vulnerabilities in the software's communication over plain HTTP to execute DNS hijacking. This manipulation redirected requests from the keyboard software to servers under the attackers' control.

Tencent, which owns the Sogou Input Method, addressed this vulnerability in version 16.10, assigning it the identifier CVE-2026-120422. Researchers from ESET discovered the method used by the attackers, initially suspecting a software exploit due to the wide spread of infections. However, they later identified DNS hijacking as the mechanism.

The attack involves a component of Sogou called SGTool.exe, which typically requests a settings file to download an icon for a "brand promotion" feature. In compromised networks, attackers manipulated the DNS response to direct this request to their servers, which returned a malicious settings file. This file instructed Sogou to download a legitimate Adobe helper program and the DarkVigil implant, disguised as a library file.

Utilizing DLL side-loading, the attackers managed to execute the malware whenever Sogou installed or loaded a component, achieving persistent access without additional setup. The exact point of hijacking remains undetermined, though compromised routers or interception at the internet provider level are suspected.

DarkVigil is a modular toolset that communicates with its control server using the Duplex Message Transport Protocol, allowing dynamic deployment of plugins stored in the Windows registry. The campaign has targeted various entities, including a company in Sri Lanka and an internet café in Dubai, aligning with Chinese state interests according to ESET's analysis. Users are advised to update to the latest version of Sogou Input Method and to monitor network connections for anomalies.