How SlippyNunchucks Turned a Sogou IME Update Channel Into a DarkVigil Backdoor Delivery Pipeline
Executive Summary
Executive Summary Beginning July 1, 2026, a China-aligned threat actor tracked as SlippyNunchucks launched a DNS hijacking campaign targeting the Sogou Input Method—a popular Chinese-language IME developed by Tencent—to deploy the DarkVigil backdoor (CVE-2026-120422). By intercepting unencrypted HTTP requests from the legitimate SGTool.exe component and redirecting them to attacker-controlled staging servers, the group delivered a malicious configuration that triggered DLL sideloading of the DarkVigil implant. Targets included organizations and Chinese-speaking individuals across Hong Kong, Thailand, Japan, Vietnam, Oman, and Sri Lanka, with notable surveillance activity against online betting platforms. Tencent patched the vulnerability on October 29, 2026, by migrating affected traffic to HTTPS.
This incident underscores a accelerating trend of nation-state actors weaponizing trusted, widely-deployed software supply chains—particularly Chinese-language applications—to reach diaspora communities and regulated industries across Asia and Europe. As DNS-based interception and DLL sideloading grow more prevalent, organizations face mounting pressure to enforce encrypted transit, zero-trust segmentation, and egress controls as baseline hygiene.
Why This Matters Now
Why This Matters NowSupply-chain DNS hijacking via unencrypted HTTP is an increasingly exploited vector by China-nexus groups in 2026, with multiple campaigns (SlippyNunchucks, UNC3569) now targeting the same Sogou IME attack surface within weeks of each other. Regulators under NIST CSF 2.0, PCI DSS 4.0, and CISA's Zero Trust Maturity Model are actively requiring encrypted data-in-transit and network segmentation controls—gaps this attack directly exposed. Organizations relying on legacy software with unencrypted update or configuration channels face immediate, unmitigated risk.
Attack Path Analysis
Attack Path AnalysisSlippyNunchucks exploited unencrypted HTTP communications in Sogou Input Method by hijacking DNS resolution to redirect the app's branded vocabulary configuration endpoint to attacker-controlled staging servers, delivering DarkVigil via DLL sideloading through a legitimate Adobe executable. Once implanted, DarkVigil established C2 using the Duplex Message Transport Protocol (DMTP), enabling plugin-based persistence, surveillance, and data collection against Chinese-speaking targets across Asia and Europe.
Kill Chain Progression
Kill Chain ProgressionThis analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
DescriptionThe attacker hijacked DNS resolution for the Sogou Input Method domain 'config.pinyin.sogou[.]com', redirecting the app's HTTP-based branded vocabulary configuration requests to attacker-controlled staging servers (sogou-cdn[.]com and dev.soft-png-cdn.com). Because SGTool.exe communicated over unencrypted HTTP with no certificate validation, the malicious configuration was served without detection. The configuration instructed the binary to download a legitimate Adobe executable and a rogue DLL (libcef.dll) containing DarkVigil, which was then loaded via DLL sideloading. This abused CVE-2026-120422 in Sogou Input Method prior to version 16.10.
Related CVEs
Related CVEsCVE-2021-38003
CVSS 8.8A type confusion vulnerability in the V8 JavaScript engine used in Google Chrome (and other Chromium-based applications) allows a remote attacker to potentially exploit heap corruption via a crafted HTML page, enabling arbitrary code execution. This outdated, unsandboxed Chromium engine embedded in Sogou Input Method's CEF-based WebView was cited as part of the exploit chain used by UNC3569 to deliver the GRAYRABBIT backdoor.
Affected Products:
Google Chrome – < 95.0.4638.69
Tencent Sogou Input Method – < 16.10
Exploit Status:
exploited in the wildReferences:
https://nvd.nist.gov/vuln/detail/CVE-2021-38003https://chromereleases.googleblog.com/2021/10/stable-channel-update-for-desktop_28.htmlhttps://starlabs.sg/blog/2022/12-thehole-new-world-how-a-small-leak-will-sink-a-great-browser-cve-2021-38003/https://www.cisa.gov/known-exploited-vulnerabilities-catalog
MITRE ATT&CK® Techniques
MITRE ATT&CK® TechniquesCompromise Infrastructure: DNS Server
Supply Chain Compromise: Compromise Software Supply Chain
Application Layer Protocol: DNS
Hijack Execution Flow: DLL Side-Loading
Ingress Tool Transfer
Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Screen Capture
Exfiltration Over C2 Channel
Potential Compliance Exposure
Potential Compliance ExposureMapping incident impact across multiple compliance frameworks.
NIST SP 800-53 Rev. 5 – Secure Name / Address Resolution Service
Control ID: SC-20 / SC-21
PCI DSS 4.0 – Secure Software and Patch Management / Protection Against Known Vulnerabilities
Control ID: Requirement 6.3.3 / 6.4.1
NIS2 Directive (EU) 2022/2555 – Risk Management — Supply Chain Security and Incident Handling
Control ID: Article 21(2)(a) and 21(2)(e)
DORA (EU) 2022/2554 – ICT Security — Network Integrity and Threat Intelligence
Control ID: Article 9(2) / Article 10
CISA Zero Trust Maturity Model 2.0 – Encrypted Traffic Inspection and Application-Level Trust Validation
Control ID: Network Pillar — Macro/Micro Segmentation; Application Workload Pillar — Application Security
ISO/IEC 27001:2022 – Management of Technical Vulnerabilities / Managing Information Security in the ICT Supply Chain
Control ID: Annex A 8.8 / Annex A 5.21
Sector Implications
Sector ImplicationsIndustry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Government Administration
China-aligned SlippyNunchucks supply-chain backdoor via Sogou DNS hijacking targets government-adjacent organizations, exposing unencrypted C2 traffic and lateral movement risks requiring Zero Trust segmentation and egress enforcement per NIST.800-53.SC-7.
Gambling/Casinos
ESET confirmed significant DarkVigil surveillance against Chinese-language online betting operators in Sri Lanka, Hong Kong, and Philippines, with DMTP-based C2 exfiltrating data through unmonitored outbound channels evading egress policy controls.
Information Technology/IT
Supply-chain compromise of Sogou Input Method and QuickFox VPN via DNS hijacking and DLL sideloading exposes IT organizations deploying Chinese-language software, demanding multicloud visibility, encrypted traffic enforcement, and inline IPS per PCI.4.0.6.4.1.
Telecommunications
DNS hijacking infrastructure abusing unencrypted HTTP in widely deployed input software mirrors Salt Typhoon-style interception tactics, placing telecom DNS resolution integrity and east-west traffic security under critical ZTMM.Network and HIPAA.164.312(e)(1) compliance risk.
Sources
Sources- China-Aligned Hackers Hijack Sogou Input Method DNS Requests to Deploy DarkVigil Backdoorhttps://thehackernews.com/2026/11/china-aligned-hackers-hijack-sogou.htmlVerified
- ESET Research: SlippyNunchucks hijacks Sogou Input Method brand promotion mechanism to distribute malwarehttps://www.welivesecurity.com/en/eset-research/slippynunchucks-hijacks-sogou-input-methods-brand-promotion-mechanism-to-distribute-malware/Verified
- Gen Digital: One-Click Backdoor via Sogou Input Method (CVE-2026-51990 research)https://www.gendigital.com/blog/insights/research/one-click-backdoor-sogouVerified
- The Hacker News: QuickFox Supply Chain Attack Delivers DarkVigilhttps://thehackernews.com/2026/08/quickfox-supply-chain-attack-delivers.htmlVerified
- NVD: CVE-2021-38003 - V8 Type Confusion Vulnerability in Google Chromehttps://nvd.nist.gov/vuln/detail/CVE-2021-38003Verified
- CISA Known Exploited Vulnerabilities Cataloghttps://www.cisa.gov/known-exploited-vulnerabilities-catalogVerified
- StarLabs: The Hole New World - CVE-2021-38003 Deep Divehttps://starlabs.sg/blog/2022/12-thehole-new-world-how-a-small-leak-will-sink-a-great-browser-cve-2021-38003/Verified
Frequently Asked Questions
Frequently Asked QuestionsCloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF is directly relevant to this campaign because the attacker relied on unencrypted outbound HTTP, DNS hijacking, and unrestricted east-west movement to deliver, stage, and operate DarkVigil across multiple network segments. Enforced segmentation, controlled egress, and identity-aware routing policies would likely have reduced the attacker's reachability at multiple stages and constrained the overall blast radius of the operation.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: Unencrypted outbound HTTP traffic from workloads to external configuration endpoints would likely be constrained by policy, reducing the reachability of attacker-controlled staging infrastructure and limiting the delivery surface for the malicious DLL payload.
Control: Zero Trust Segmentation
Mitigation: Zero Trust segmentation policies would likely constrain the network-level reach of processes spawned from sideloaded contexts, reducing the scope of what the implant could access from within the compromised workload's trust boundary.
Control: East-West Traffic Security
Mitigation: East-west traffic enforcement would likely reduce the number of reachable internal workloads from any single compromised node, constraining the attacker's ability to propagate the DarkVigil plugin framework laterally across segments.
Control: Multicloud Visibility & Control
Mitigation: Multicloud visibility and centralized traffic control would likely surface anomalous outbound protocol behavior associated with DMTP, and policy enforcement could reduce the reachability of attacker C2 infrastructure across cloud and hybrid network paths.
Control: Egress Security & Policy Enforcement
Mitigation: Controlled egress policies would likely constrain outbound data flows to approved destinations and protocols, reducing the attacker's ability to exfiltrate collected data over custom encrypted channels to unvetted external infrastructure.
If prior Zero Trust and egress controls had constrained lateral movement and C2 reachability, the attacker's dwell time and collection scope across multiple countries and organizations would likely have been meaningfully reduced, limiting the volume of surveillance data exfiltrated over the campaign's duration.
Impact at a Glance
Affected Business Functions
- Endpoint Security and User Device Integrity
- Corporate Communications and Collaboration Platforms
- Online Betting Platform Operations (Sri Lanka, Hong Kong, Philippines)
- Chinese-Language User Data Processing and Input Services
Estimated downtime: N/A
Estimated loss: N/A
The DarkVigil backdoor and its 20+ modular plugins enabled persistent surveillance and data collection on targeted organizations and individuals. Exposed data categories include: keystrokes and input method data (capturing sensitive credentials and communications via Sogou IME), organizational communications from Chinese-speaking employees and users across Hong Kong, Thailand, Japan, Vietnam, Oman, and Sri Lanka, proprietary operational data from Chinese-language online betting platforms (which carry heightened legal and regulatory sensitivity given China's gambling restrictions), and personal identifiable information of Chinese-speaking diaspora users across Asia and Europe. The modular DMTP-based C2 framework allowed selective plugin deployment for persistence, credential harvesting, and network reconnaissance, suggesting long-term dwell time and broad data exfiltration across multiple victim organizations.
Recommended Actions
Key Takeaways & Next Steps
- • Enforce Egress Security & Policy Enforcement (CNSF): Deploy FQDN-based egress filtering and outbound traffic policy enforcement to detect and block connections to unauthorized staging servers such as sogou-cdn[.]com; DMTP-based C2 channels should be identified via anomalous outbound connection baselining and blocked before data exfiltration occurs.
- • Apply Encrypted Traffic Controls (HPE): Mandate HTTPS/TLS for all software update and configuration fetch mechanisms in supply chain applications—Sogou Input Method's unencrypted HTTP config pull was the root enabler of DNS hijacking; network-layer encryption (IPsec/MACsec) for transit paths and strict certificate validation at the application level eliminates this vector.
- • Implement East-West Traffic Security and Zero Trust Segmentation: Restrict workload-to-workload communication using identity-based microsegmentation policies so that a compromised endpoint running DarkVigil cannot pivot laterally to reach sensitive internal services or other network segments without explicit policy authorization.
- • Deploy Multicloud Visibility & Control for C2 Detection: Instrument centralized traffic observability across all endpoints and cloud workloads to detect anomalous custom-protocol (DMTP) communications, repeated configuration fetch anomalies, and suspicious outbound connections to newly registered or low-reputation domains associated with staging infrastructure.
- • Leverage Cloud Native Security Fabric (CNSF) for Supply Chain Inline Enforcement: Apply real-time inline inspection and distributed policy enforcement at ingress and egress points to detect DLL sideloading patterns, unsigned binary executions by legitimate processes (SGTool.exe, biz_helper.exe), and plugin download activity indicative of modular implant staging, closing the gap between DNS hijacking and payload execution.
