SlippyNunchucks and the Sogou Trap: How a Chinese IME's HTTP Gap Became a Nation-State Espionage Vector
Executive Summary
Executive Summary Beginning July 1, 2026, the China-aligned APT group SlippyNunchucks exploited an unencrypted HTTP endpoint within Sogou Input Method's brand promotion mechanism to deliver the DarkVigil espionage implant (also tracked as FDMTP) to victims across Hong Kong, Thailand, Japan, Vietnam, Oman, and Sri Lanka. By hijacking DNS resolution of config.pinyin.sogou[.]com and redirecting traffic to attacker-controlled staging servers, SlippyNunchucks served a malicious AES-256-CBC encrypted configuration that instructed the legitimate SGTool.exe component to download and side-load the DarkVigil implant via DLL hijacking. The group had previously abused the QuickFox supply chain before pivoting to this DNS hijacking technique. Tencent released a patched version (16.10) on October 30, 2026, migrating the affected requests to HTTPS with certificate pinning.
This incident highlights a growing trend among China-aligned APT actors of weaponizing trusted, widely installed software used by Chinese-speaking diaspora communities to conduct persistent surveillance. The abuse of legitimate application update and configuration mechanisms—rather than zero-day exploits—underscores the difficulty of detecting such campaigns and the critical importance of enforcing encrypted transit for all application communications.
Why This Matters Now
Why This Matters NowDNS hijacking against unencrypted application telemetry channels is an increasingly preferred initial-access technique for state-sponsored actors because it leaves minimal endpoint forensic artifacts and bypasses perimeter defenses. With millions of Sogou Input Method installations worldwide, any organization hosting Chinese-speaking employees or operating in Asia-Pacific is a plausible target. The CVE-2026-120422 disclosure and the rapid pivot from supply-chain compromise to DNS hijacking demonstrate that APT groups adapt faster than enterprise patch cycles, making network-layer encrypted-transit enforcement and egress anomaly detection urgent priorities.
Attack Path Analysis
Attack Path AnalysisSlippyNunchucks conducted a DNS hijacking operation targeting users of Sogou Input Method (SGTool.exe), intercepting unencrypted HTTP requests to a legitimate Tencent backend and substituting a malicious configuration that caused the download and side-loading of the DarkVigil implant via a legitimate Adobe binary. Once resident on victim endpoints, the DarkVigil modular implant established encrypted DMTP-based C2 communications, orchestrated plugin delivery and execution, and exfiltrated victim data back to attacker-controlled infrastructure hosted on Alibaba Cloud, completing a stealthy espionage operation targeting Chinese-speaking individuals and organizations across Asia and Europe.
Kill Chain Progression
Kill Chain ProgressionThis analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
DescriptionSlippyNunchucks hijacked DNS resolution of config.pinyin.sogou[.]com — an official Sogou Input Method backend — redirecting it to attacker-controlled staging servers (47.239.250[.]102, 47.237.122[.]175) hosting the domain sogou-cdn[.]com. Because SGTool.exe communicated with this endpoint over unencrypted HTTP (not HTTPS), there was no TLS certificate validation to detect the substitution. The attacker responded to the legitimate getBrandScd.php configuration request with a malicious AES-256-CBC-encrypted payload instructing download of the DarkVigil implant (libcef.dll) and a signed Adobe binary (biz_helper.exe) to specific paths within the Sogou component directory. The point of DNS manipulation (compromised routers, ISP-level interception, or malicious DNS configuration) remains unconfirmed.
Related CVEs
Related CVEsCVE-2026-120422
CVSS 8.9Sogou Input Method (SGTool.exe component) communicates with backend configuration endpoints over unencrypted HTTP, allowing an attacker with DNS hijacking capability to intercept and replace legitimate configuration responses with malicious payloads, leading to arbitrary code execution via DLL side-loading through the application's existing component management workflows.
Affected Products:
Tencent Sogou Input Method (Sogou Pinyin) – < 16.10
Exploit Status:
exploited in the wildCVE-2026-51990
CVSS 9.8A remote code execution vulnerability in Sogou Input Method that was independently disclosed by Gen Threat Labs, enabling attackers to execute arbitrary code on affected systems.
Affected Products:
Tencent Sogou Input Method (Sogou Pinyin) – unspecified versions prior to patch
Exploit Status:
exploited in the wild
MITRE ATT&CK® Techniques
MITRE ATT&CK® TechniquesContent Injection
Adversary-in-the-Middle
Hijack Execution Flow: DLL Side-Loading
Masquerading: Match Legitimate Resource Name or Location
Modify Registry
Ingress Tool Transfer
Application Layer Protocol: Web Protocols
Exfiltration Over C2 Channel
Potential Compliance Exposure
Potential Compliance ExposureMapping incident impact across multiple compliance frameworks.
NIST SP 800-53 Rev 5 – Secure Name/Address Resolution Service
Control ID: SC-20 / SC-21
CISA Zero Trust Maturity Model 2.0 – Enforce Encrypted and Authenticated Network Communications
Control ID: Network Pillar — Encrypted Traffic Inspection
NIS2 Directive (EU) 2022/2555 – Supply Chain Security and Software Integrity
Control ID: Article 21(2)(h)
PCI DSS 4.0 – Secure Software and Change Management
Control ID: Requirement 6.3.3 / 6.4.1
DORA (EU Regulation 2022/2554) – ICT Asset Integrity and Third-Party Software Risk Management
Control ID: Article 9 — ICT Security Policies; Article 28 — ICT Third-Party Risk
ISO/IEC 27001:2022 – Secure Software Development and Third-Party Component Integrity
Control ID: Annex A 8.28 — Secure Coding; Annex A 5.23 — Information Security for Use of Cloud Services
Sector Implications
Sector ImplicationsIndustry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Gambling/Casinos
SlippyNunchucks directly targeted multinational Chinese-language online betting operators in Sri Lanka, Hong Kong, and Philippines via DarkVigil implants, enabling C2 exfiltration and lateral movement against gambling infrastructure.
Information Technology/IT
Supply-chain abuse and DNS hijacking of Sogou Input Method's unencrypted HTTP traffic expose IT environments to APT espionage implants, requiring zero trust segmentation, egress security, and encrypted transit enforcement per NIST.800-53.SC-7.
Higher Education/Acadamia
ESET telemetry confirms university students targeted by SlippyNunchucks DarkVigil implants; academic networks using Chinese IME software face credential exfiltration risk over unmonitored east-west and outbound C2 channels.
Government Administration
China-aligned APT espionage implant targeting Chinese-speaking individuals across Asia and Europe poses significant threat to government administration entities, with DNS hijacking enabling covert data exfiltration violating NIST.CSF.PR.DS-2 and ZTMM.Data controls.
Sources
Sources- SlippyNunchucks hijacks Sogou Input Method’s brand promotion mechanism to distribute malwarehttps://www.welivesecurity.com/en/eset-research/slippynunchucks-hijacks-sogou-input-methods-brand-promotion-mechanism-to-distribute-malware/Verified
- Earth Preta New Malware and Strategies - Trend Microhttps://www.trendmicro.com/en/research/24/i/earth-preta-new-malware-and-strategies.htmlVerified
- QuickFox Supply Chain Attack Used to Deploy FDMTP Implant - Fortinethttps://www.fortinet.com/blog/threat-research/quickfox-supply-chain-attack-used-to-deploy-fdmtp-implantVerified
- Vulnerabilities in Sogou Keyboard Encryption - Citizen Labhttps://citizenlab.ca/research/vulnerabilities-in-sogou-keyboard-encryption/Verified
- One-Click Backdoor: Sogou Remote Code Execution - Gen Threat Labshttps://www.gendigital.com/blog/insights/research/one-click-backdoor-sogouVerified
- ESET Malware IoC Repository - SlippyNunchuckshttps://github.com/eset/malware-ioc/tree/master/slippynunchucks/Verified
- CVE-2026-51990 Record - CVE.orghttps://www.cve.org/CVERecord?id=CVE-2026-51990Verified
Frequently Asked Questions
Frequently Asked QuestionsCloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF is relevant to this incident because SlippyNunchucks exploited uncontrolled HTTP egress and flat network reachability to deliver the DarkVigil implant and sustain encrypted C2 communications across cloud-hosted infrastructure. Enforcing identity-aware segmentation and controlled egress policies would likely have constrained the attacker's ability to reach victim workloads, deliver plugins, and exfiltrate data without detection.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: Unencrypted outbound HTTP traffic from workloads toward unrecognized external destinations could be constrained by fabric-level egress policy, likely reducing the reachability of attacker-controlled staging infrastructure and limiting the window for malicious configuration delivery.
Control: Zero Trust Segmentation
Mitigation: Zero Trust segmentation would likely constrain the lateral propagation scope of workloads that have undergone trust abuse, reducing the ability of a compromised application context to reach additional internal resources or propagate implants to adjacent network segments.
Control: East-West Traffic Security
Mitigation: East-west traffic enforcement would likely reduce the reachability of compromised endpoints to adjacent workloads, constraining the ability of DarkVigil's relay and plugin-delivery mechanisms to traverse internal network boundaries and limiting the blast radius of any intra-network propagation attempt.
Control: Multicloud Visibility & Control
Mitigation: Multicloud visibility and policy enforcement would likely reduce the ability of implant traffic to blend into legitimate cloud-bound flows, constraining outbound connections to Alibaba Cloud-hosted C2 endpoints that fall outside approved cloud service destinations and limiting unmonitored protocol tunneling over HTTP and WebSocket.
Control: Egress Security & Policy Enforcement
Mitigation: Controlled egress policy enforcement would likely constrain the outbound paths available to the DarkVigil implant, reducing the reachability of attacker-controlled Alibaba Cloud endpoints and limiting the volume and frequency of encrypted exfiltration traffic that can leave the network uncontested.
Had earlier segmentation and egress controls constrained implant delivery and C2 reliability, the attacker's ability to sustain persistent surveillance across geographically distributed victim environments would likely have been reduced, limiting the scope of data collection and narrowing the population of reachable targets.
Impact at a Glance
Affected Business Functions
- End-user Workstation Integrity and Security (Chinese-speaking enterprise and individual users)
- Organizational Data Confidentiality and Exfiltration Prevention
- Online Gambling Platform Operations (targeted multinational betting organizations)
- University and Academic Network Security
Estimated downtime: N/A
Estimated loss: N/A
The DarkVigil implant, delivered silently via DNS hijacking of Sogou Input Method's update mechanism, enabled covert long-term espionage across targeted organizations. Data at risk includes: victim system profiles (username, machine name, MAC address, HWID), keystrokes and input data captured via the compromised IME context, files and credentials exfiltrated by modular DarkVigil plugins (including a plugin named Pillager), internal communications and operational data of a multinational online gambling organization operating in Sri Lanka, Hong Kong, and the Philippines, and personally identifiable information of Chinese-speaking individuals across Hong Kong, Thailand, Japan, Vietnam, Oman, Sri Lanka, Germany, Russia, the UK, Austria, and Denmark. The covert, persistent nature of the implant means data exfiltration may have continued undetected for weeks to months across affected environments.
Recommended Actions
Key Takeaways & Next Steps
- • Enforce Egress Security & Policy (CNSF: Egress Security & Policy Enforcement): Deploy FQDN-based egress filtering and outbound traffic controls to detect and block connections to attacker-controlled domains (sogou-cdn[.]com, mssproxy[.]net, wangmengfun[.]top) at the network perimeter; policy enforcement should flag or deny DNS resolution responses pointing to unexpected IP ranges (e.g., Alibaba Cloud IPs for a Tencent service FQDN) before HTTP requests are fulfilled.
- • Deploy Inline IPS with DNS Anomaly Signatures (CNSF: Inline IPS / Suricata): Implement inline intrusion prevention with signatures targeting DNS hijacking patterns — specifically mismatches between expected authoritative IP ranges for well-known vendor FQDNs and resolved IPs — as well as known DarkVigil/DMTP protocol fingerprints and malicious payload hashes to intercept delivery at the network layer before implant execution.
- • Apply Multicloud Visibility & C2 Traffic Detection (CNSF: Multicloud Visibility & Control): Enable centralized traffic observability and anomaly baselining to detect unusual outbound DMTP/TCP communication patterns from endpoint processes such as SGTool.exe or biz_helper.exe to non-standard Alibaba Cloud IPs; alert on first-seen domain contacts and high-entropy binary protocol traffic indicative of C2 beaconing.
- • Enforce Zero Trust Segmentation to Limit Blast Radius (CNSF: Zero Trust Segmentation): Apply identity-based microsegmentation policies to restrict which processes and workloads can initiate outbound internet connections; legitimate IME components like SGTool.exe should not require direct internet egress outside of approved vendor IP ranges, and any deviation should trigger automated policy block and alert.
- • Encrypt and Validate All Vendor Update Channels (CNSF: Encrypted Traffic / HPE): Mandate that all software update and configuration retrieval channels use TLS with certificate pinning and validation — mirroring Tencent's remediation in version 16.10 — and enforce network-layer controls that drop plaintext HTTP traffic from software update processes, preventing DNS-hijack-based configuration injection regardless of DNS integrity at the resolver level.
