ESET says DNS hijacking turned a Sogou Input Method icon request into a DarkVigil implant install

121 days between the first launch ESET saw and the fixed version

ESET says that beginning on 1 July 2026 it saw people in Hong Kong, Thailand, Japan, Vietnam, Sri Lanka and Oman receive a spying implant while they used Sogou Input Method, one of the most widely used Chinese input method editors. Tencent, which owns Sogou, released version 16.10 with the fix on 30 October 2026. That is 121 days from the first launch ESET reports to the fixed version (derived). This briefing reads ESET's blog post of 4 November 2026 in full, the CVE record ESET issued for the flaw, and Sogou's own changelog page, on 4 November 2026, from 16:03 UTC.

The striking part is not the implant. It is how it arrived. ESET says nobody broke the application. A legitimate Sogou component, SGTool.exe, asked a Sogou server over plain HTTP for a small configuration file that tells it which icons to fetch for sponsored brand names in its vocabulary. Someone controlled the DNS answer for that server in the victims' environments, so the request went to an attacker's staging server, which sent back a configuration of its own. Sogou's own code then downloaded two files, wrote them where its own component manager lives, and later ran them. ESET says this gave persistence "without requiring a separate persistence mechanism".

ESET calls the operator SlippyNunchucks and the toolset DarkVigil, also known as FDMTP. It says the group is a "China-aligned threat actor" active since at least 15 September 2023, and it assesses "with high confidence" that the group is associated with a nation state surveillance effort aligned with the interests of the Chinese government. ESET sells security products and threat intelligence, and it found this activity in its own telemetry; it says so in the post, and readers should weigh the report with that in mind.

What the 121 days do not establish

The figure starts at the first launch ESET saw, not at the first attack. ESET's own indicator table lists one hijacking domain as first seen on 7 June 2026, 24 days before 1 July (derived), and the two staging servers it names in the text as first seen on 21 July (also derived: 20 days after). A first seen date is when ESET first recorded an indicator. It is not proof that the indicator was used against Sogou users on that day.

Nor does the figure say how many people were hit. ESET prints no victim count. It says that "the volume of compromises and the geographic diversity of the victims" first gave the impression that an exploit might be involved, which suggests more than a handful, but the post gives no number for victims, for machines, or for users who were exposed without being infected. It does not say whether the campaign continued after version 16.10, or whether updating removes an implant already in place. And it does not say who changed the DNS answers, or where, because ESET does not know: "The point at which DNS manipulation occurs remains unknown."

How an icon request became an install, step by step

Sogou Input Method expands its vocabulary with collections called cell dictionaries. In April 2016, ESET writes, Sogou started a Startup Brand Support Program that let young companies submit their brand names, which then appear in the list of candidate words with a small green sprout icon. The request the attackers answered belongs to that mechanism: it fetches the configuration for downloading those icons. In a clean environment the server returns a configuration encrypted with AES 256 in CBC mode, using a key and initialisation vector embedded in SGTool.exe, and once decrypted it tells the program to download one picture of a green sprout, tree.png.

SGTool.exe is, in ESET's words, "a multipurpose task dispatcher": it reads a command ID from its command line and routes it to one of at least 30 handlers, for installation, skins, dictionary updates and other jobs. The handler behind one of those IDs sends the icon request over HTTP. ESET checked the host, config.pinyin.sogou[.]com, and found it answers over HTTPS with a valid certificate for Tencent Technology (Shenzhen) Company Limited. Yet ESET's analysis of SGTool.exe found 20 request endpoints on that host that the program called over unencrypted HTTP rather than HTTPS, including this one. The secure channel existed; the program did not use it.

Zoom

In the victims' environments, ESET says, the attacker controlled the DNS resolution of the Sogou host and pointed it at one of two staging servers, both serving an attacker controlled domain, sogou-cdn[.]com. Those servers returned a malicious configuration "encrypted in a manner similar to the legitimate one". It told SGTool.exe to download two files: a legitimate, signed Adobe Licensing WF Helper renamed biz_helper.exe, and libcef.dll, which is the DarkVigil implant. The attacker set the configuration's md5 fields to match the two payloads, so the program's own integrity check passed, and used the icon fields to choose where the files would be written.

ESET describes two places, each chosen so that Sogou would run the files itself. In the first, the Adobe binary is saved as \Components\SogouComMgr.exe, the name of Sogou's component management utility. Whenever SGTool.exe tries to install or load a component it now starts the Adobe binary, which side loads the malicious libcef.dll beside it. In the second, both files go into a versioned folder under \Components\biz_center, which Sogou loads when it invokes its BizCenterCom component; ESET says SGTool.exe did this frequently. That route survives an update that overwrites SogouComMgr.exe, but not one that brings a new biz_center version. ESET adds that only one route can work at a time, and that both are "highly destructive and likely to cause software failures", which is a clue a help desk might see before a security team does.

Zoom

Encrypted, checked, signed: three comforting words that protected nothing

Each step of this chain carried a label that sounds like a control. None of them was one, and the reason is the same in each case: the check and the thing being checked came down the same untrusted channel.

Encrypted. The configuration was encrypted, but the key and initialisation vector sit inside the shipped program, so the encryption hid the content from a casual observer without proving who wrote it. ESET says the malicious configuration was encrypted the same way. Encryption without authentication is a lock whose key is taped to the door. That comparison is this site's, not ESET's.

Checked. The configuration carries an md5 value for each file it names, and SGTool.exe checks the download against it. ESET says the attacker simply set those values to match the payloads, "allowing for control of the integrity validation". A hash delivered by the same party who delivers the file proves only that the file arrived intact from that party.

Signed. The program that runs first is a genuine, signed Adobe binary. Its signature is real and tells a defender nothing about whether it belongs in Sogou's folder under Sogou's file name. ESET maps this to the MITRE ATT&CK technique for masquerading under a legitimate name or location, and the side loading of libcef.dll to DLL hijacking.

Two words in the coverage need care as well. "Hijack" in ESET's title is of a request in a promotion mechanism, not of Sogou's servers: ESET describes no compromise of Sogou or Tencent infrastructure, and it found the real host serving a valid certificate. "Supply chain" is a term ESET uses for the group's earlier distribution method, a compromise of an application called QuickFox, analysed by Fortinet and in an ESET threat intelligence report. ESET does not call the Sogou operation a supply chain compromise; it calls it a DNS hijacking operation abusing insecure HTTP. The difference matters to a defender. Sogou's own code and servers were working as designed, and the design trusted the network.

Where the DNS answer was changed: ESET does not know

This is the gap at the centre of the report. ESET says the hijacking vector is "unresolved". It names three suspected possibilities: compromised routers with modified and malicious DNS settings, routers compromised with an implant that hijacks DNS requests, or interception at the ISP level. Its conclusion says the actor intercepts DNS resolution "in the victims' environments via an undiscovered method". ESET's ATT&CK table lists adversary in the middle for this step, with the plain sentence that the DNS resolution of the Sogou host "was controlled by the attacker".

Those three possibilities are very different problems. A home or small office router with changed DNS settings is something an owner can find and fix. A router running an implant is harder to see. Interception at a provider is outside the user's reach entirely. ESET does not say which, and this briefing does not guess. What can be said, and is this site's reasoning rather than ESET's, is that the vendor's fix makes the answer to that question matter less for this one request: with HTTPS and certificate pinning, a forged DNS answer leads the program to a server that cannot prove it is Sogou's, wherever the forgery happens.

The same reasoning shows the limit of the fix. An update to one program does not remove the attacker's position on the DNS path, wherever it is. Any other program on such a network that fetches instructions over plain HTTP from a host the attacker chose to redirect would be exposed in the same way. That is this site's inference. ESET's post concerns Sogou Input Method and does not report on other software on the victims' networks.

Who was targeted, and what the China-aligned label rests on

For the Sogou campaign, ESET names six places: Hong Kong, Thailand, Japan, Vietnam, Sri Lanka and Oman, and says the operation targeted organisations and Chinese speaking individuals there. For the group over its whole history, ESET says it mainly targets organisations and Chinese speaking individuals across South and East Asia, and occasionally victims in Europe, including individuals in Germany, Russia, the UK and Austria. ESET's notable victims for the group are a multinational gambling organisation operating out of Sri Lanka, the Philippines and Hong Kong, an internet café in Dubai, and a university student in Denmark. It names none of them, and neither does this briefing. Some coverage presents those notable victims as victims of the Sogou campaign; ESET lists them in its profile of the group, not in its campaign overview.

ESET says SlippyNunchucks has abused several applications since 2025 to deploy DarkVigil, listing Sogou Input Method, QuickFox, QingTalk, MiYunChat, SoftCam and tawk.to, and that this has let it reach Chinese speaking users abroad. The attribution rests on two things the post names: "consistent patterns in the victimology and tactics", and what ESET calls significant surveillance of an organisation running Chinese language online betting platforms in Sri Lanka, Hong Kong and the Philippines, which ESET reads against China's criminal penalties for operating gambling businesses and organising Chinese citizens to gamble abroad. ESET places this in a pattern it says it has seen of China-aligned groups appearing to support law enforcement action against Chinese individuals linked to fraud schemes in the region.

The label is ESET's assessment with stated evidence. It is not a government attribution, and ESET does not claim to have identified an agency or a person. ESET also disagrees with earlier public reporting: it says reporting that attributes DarkVigil to Mustang Panda, also known as Twill Typhoon, is not supported by its telemetry, which shows no overlap, and it tracks SlippyNunchucks as a distinct group with no known association to Mustang Panda. ESET links a Trend Micro article where it names FDMTP; Infosecurity Magazine attributes the Mustang Panda link to Darktrace instead. This briefing did not read either of those and records only that ESET disputes the link.

What DarkVigil is, in ESET's description

ESET describes DarkVigil as a modular .NET toolset: the implant plus more than 20 known plugins, built on a malware framework whose internal name is Vigil, which is in turn built on TouchSocket, a networking framework. Data the implant takes is managed in a web administration panel also branded Vigil. The implant's main job, ESET says, is to run and orchestrate plugins that "install persistence or perform data collection". The post names one plugin, Pillager, and does not list what the others collect.

The part ESET calls most interesting is the transport. DarkVigil talks to its command server with the Duplex Message Transport Protocol, DMTP, a binary protocol that can run over TCP, UDP, HTTP, WebSocket or named pipes. Two features make it suit a backdoor, in ESET's account: remote procedure calls that can run in both directions, so the server can call code on the client and the client on the server; and channels between clients as well as between client and server, which lets each plugin talk to the server through the implant as a relay. On connection the implant sends a profile of the victim, and each machine gets an ID built from a hardcoded mutex and details such as user name, machine name and network card address. The server pushes plugins with DMTP's file transfer and the implant stores them compressed in the Windows registry before loading them.

ESET says its protocol analysis was done in 2025 and that newer versions "may have additional features or different method names". Treat the protocol detail as a guide to the family, not a signature for every sample.

The fix, its date, and what ESET says remains

ESET's disclosure timeline is short and clear. It reported the weakness to Tencent's security team on 11 September 2026; Tencent responded and acknowledged it on 21 September; Tencent addressed it in version 16.10 on 30 October; ESET, acting as a CVE numbering authority, issued CVE-2026-120422 on 2 November; and ESET published on 4 November. That is 10 days to acknowledgement and 49 days from report to fix (both derived). ESET thanks Tencent for a "swift response".

Zoom

One date needs a correction note. ESET's timeline and its later paragraph both say version 16.10 came out on 30 October, but one paragraph in the campaign overview says 29 October. Sogou's own changelog page, which the CVE record cites, lists "2026.10.30" for the 16.10 release, with a single line that translates as fixing several security issues. This briefing uses 30 October. The changelog does not mention HTTPS, pinning or the CVE.

ESET says version 16.10 moved the affected requests to HTTPS and enabled certificate pinning, which "mitigates the risk of malicious configuration delivery through DNS hijacking". The CVE record ESET published lists Sogou Input Method for Windows versions below 16.10 as affected, names the weakness as reliance on HTTP instead of HTTPS, and gives a CVSS 4.0 base score of 8.9, High, assigned by ESET. ESET then says plainly that "other security concerns remain": SGTool.exe should check the type of each file a configuration tells it to download, so that an executable cannot arrive in place of an expected image, and it should restrict where downloads are written, to prevent arbitrary file overwrites. ESET does not say Tencent has done either. The transport is now authenticated; what the program will do with an authenticated instruction is unchanged on the record.

Stated, assessed, and not stated

Zoom

Technical details

Every block below is copied from the source named in its caption. Live infrastructure is defanged as ESET defangs it, with [.] in place of a dot. ESET says a fuller list of indicators and samples is in its GitHub repository; when this site checked through GitHub's API in the afternoon of 4 November 2026 (UTC), the folder ESET links did not exist yet, so nothing here comes from it. No sample, script or decoded payload is reproduced, and this site did not contact any of the addresses.

The legitimate request. This is the Sogou host and endpoint SGTool.exe calls for the brand icon configuration, and the command line argument whose handler sends it. The host is Sogou's own; it is not an indicator of compromise. A defender with proxy or DNS logs can look for this path requested over plain HTTP, and for the host resolving to anything other than Sogou's addresses.

config.pinyin.sogou[.]com/api/brandScd/getBrandScd.php

SGTool.exe --appid=scdreg -update

The legitimate certificate ESET saw on that host over HTTPS. Useful to anyone who wants to confirm that their own network presents the same one.

config.pinyin.sogou[.]com
Tencent Technology (Shenzhen) Company Limited
SHA-1: F4E0B9A3B3FA449DFC77A596B44B4560B4D05A57

Network indicators, exactly as ESET's table prints them. The last three rows are the hijacking domains and staging servers; the first four are DarkVigil bootstrap infrastructure. Block and hunt for these in DNS, proxy and firewall logs; on ESET's description, a Sogou host resolving to one of the staging addresses is a direct sign of this campaign.

IP               Domain                   Hosting provider                   First seen  Details
N/A              blog.wangmengfun[.]top   N/A                                2026-07-08  DarkVigil bootstrap domain.
N/A              update.mssproxy[.]net    N/A                                2026-08-06  DarkVigil bootstrap server.
N/A              img.fusfun[.]top         N/A                                2026-08-06  DarkVigil bootstrap server.
47.86.15[.]162   N/A                      ALIBABA CLOUD - HK                 2026-08-08  DarkVigil bootstrap server.
47.236.254[.]159 dev.soft-png-cdn[.]com   Alibaba (US) Technology Co., Ltd.  2026-06-07  Hijacking domain and staging server.
47.237.122[.]175 sogou-cdn[.]com          Alibaba (US) Technology Co., Ltd.  2026-07-21  Hijacking domain and staging server.
47.239.250[.]102 sogou-cdn[.]com          Alibaba (US) Technology Co., Ltd.  2026-07-21  Hijacking domain and staging server.

File indicators. The first two are DarkVigil implants in ESET's table. The third is the legitimate signed Adobe binary the configuration renames to biz_helper.exe: it is not malware, but finding it in a Sogou folder, or under the name SogouComMgr.exe, is a strong sign.

SHA-1                                     Filename                                                  Detection               Description
8A60A8E90E1F5F08F28FE5A6DD57BD686C20DC23  libcef.dll                                                Win64/Agent.KSV         DarkVigil implant.
3E16BA611782AF6E45576D390488D28FD676BADE  Microsoft.VisualStudio.HostingProcess.Utilities.Sync.dll  MSIL/DarkVigil_AGen.D.  DarkVigil implant.

79188C8DE2378B437D39E867475C5B4714A0D7C9  biz_helper.exe (legitimate signed Adobe Licensing WF Helper, renamed)

Where the files land. ESET's Figure 4 shows the decrypted malicious configuration: eight entries, each with a destination path, an md5 value and a download address on the attacker's domain. This site does not reproduce the configuration. Below are only the destination folders and file names it names, with the relative prefix removed, and the two md5 values, read from ESET's image. Hunt for these files in a Sogou Input Method installation.

Program Files (x86)\SogouInput\Components\libcef.dll
Program Files (x86)\SogouInput\Components\SogouComMgr.exe
Program Files (x86)\SogouInput\Components\biz_center\1.0.0.3263\libcef.dll
Program Files (x86)\SogouInput\Components\biz_center\1.0.0.3263\biz_helper.exe
Program Files (x86)\SogouInput\Components\biz_center\1.0.0.3239\libcef.dll
Program Files (x86)\SogouInput\Components\biz_center\1.0.0.3239\biz_helper.exe
Program Files (x86)\SogouInput\Components\biz_center\1.0.0.3198\libcef.dll
Program Files (x86)\SogouInput\Components\biz_center\1.0.0.3198\biz_helper.exe

md5 given for libcef.dll:     c0d248994187db08f6413df26c4c5d8c
md5 given for biz_helper.exe: 655a56a11ff0e2f0a6078d9dc2a79461

How Sogou starts components. These are the legitimate command lines ESET reports SGTool.exe using to launch SogouComMgr.exe. In an infected installation the same command lines start the Adobe binary instead, so process creation logs where the image named SogouComMgr.exe carries an Adobe signature, or loads libcef.dll from the Components folder, are worth a query.

-installdoall <component_path>
-invoke <bundle> <component>
-remove <component>

-invoke BizCenterComBundle BizCenterCom

The registry location where DarkVigil stores plugins, compressed, before it loads them, and two build paths ESET found inside the code. HWID is a per machine ID the implant computes; the redactions are ESET's.

HKCU\Software\Microsoft\IME\<HWID>\pluginHash

C:\Users\PT\Desktop\VigilPro\Client\Dotnet\Client.Core\[redacted]
C:\Users\PT\Desktop\VigilⅢ\Client\Dotnet\Plugins\[redacted]

The DMTP message layout from ESET's Table 1, and the handshake detail. ESET says every DMTP message starts with the two byte magic value dm and that the samples it studied used the framework's default token, Dmtp. A network team can use this to recognise the protocol; ESET's caveat that newer versions may differ applies.

Section  Size (bytes)  Description
Header   2             A DMTP message always starts with the magic value dm.
Flag     2             Protocol flag. 0-19 reserved by the framework. For a TCP-DMTP connection, this flag is set to 1.
Length   4             The length of the payload.
Data     Variable      The payload.

Handshake: authentication token - the default token Dmtp was used
Proposed ID format: <internal_name>.<protocol_type>:<HWID>

The CVE record's fields. The vector string is ESET's, as the numbering authority that issued the record.

CVE-2026-120422  (assigner: ESET; reserved 2026-11-02; published 2026-11-04)
Title:    Insecure HTTP configuration retrieval in Sogou Input Method allows arbitrary code execution
Affected: Sogou Input Method, Windows, versions from 0 less than 16.10; module SGTool.exe, HTTP configuration retrieval
CWE:      CWE-1428 Reliance on HTTP instead of HTTPS
CAPEC:    CAPEC-94 Adversary in the Middle (AiTM)
CVSS 4.0: 8.9 HIGH
Vector:   CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H/S:N/R:U/V:D/RE:M

ESET's ATT&CK mapping, built on version 20 of the framework, as printed: T1659 Content Injection; T1574.001 Hijack Execution Flow: DLL; T1036.005 Masquerading: Match Legitimate Resource Name or Location; T1112 Modify Registry; T1557 Adversary-in-the-Middle; T1071.001 Application Layer Protocol: Web Protocols; T1105 Ingress Tool Transfer; T1573 Encrypted Channel; T1041 Exfiltration Over C2 Channel.

A ranked checklist, and what ESET does and does not advise

ESET's post has no section of advice for defenders. It reports the fixed version, names what it thinks the vendor should still change, and publishes indicators. Each item below says whether it comes from ESET, the CVE record, or this site.

The question the report leaves open

ESET found one program that asked a question over an open line and did what the answer said. Tencent has fixed that program's transport. The forged DNS answers came from somewhere ESET could not find, on networks that served people in six places, and nothing in the report says that position has gone. On your own estate, which installed software still fetches instructions over plain HTTP and acts on them, and would anyone notice if the answer came from someone else?

Key facts