China-aligned SlippyNunchucks hijacks Sogou Input Method's brand promotion HTTP endpoint via DNS manipulation to drop the DarkVigil modular implant on Chinese-speaking targets across Asia and Europe, patched in Sogou version 16.10 (CVE-2026-120422). Key findings: - SlippyNunchucks (active since at least September 2023, distinct from Mustang Panda per ESET's telemetry) has consistently abused popular Chinese 🇨🇳 applications including Sogou Input Method, QuickFox, QingTalk, MiYunChat, SoftCam, and tawk[.]to to reach Chinese-speaking diaspora targets. Victims span Hong Kong, Thailand 🇹🇭, Japan 🇯🇵, Vietnam 🇻🇳, Oman, and Sri Lanka 🇱🇰, with European individuals in Germany 🇩🇪, Russia 🇷🇺, the UK 🇬🇧, and Austria 🇦🇹 also hit. The targeting of a multinational Chinese-language gambling operator aligns with Chinese 🇨🇳 state enforcement interest in overseas gambling activity, reinforcing the nation-state surveillance assessment. - The attack abuses SGTool.exe, a legitimate Sogou component, which sends an unencrypted HTTP GET to config.pinyin.sogou[.]com/api/brandScd/getBrandScd.php (the brand promotion icon config endpoint, invoked via --appid=scdreg -update). DNS resolution for that host was redirected to attacker-controlled staging servers at 47.239.250[.]102 or 47.237.122[.]175, both serving the spoofed domain sogou-cdn[.]com. Those servers returned a maliciously crafted AES-256-CBC encrypted config (key and IV embedded in SGTool.exe's .rdata section) with modified md5 integrity fields pointing to attacker payloads, bypassing the application's own validation. - The malicious config drops two payloads into Sogou's Components directory: a legitimate signed Adobe Licensing WF Helper renamed biz_helper.exe (SHA-1: 79188C8DE2378B437D39E867475C5B4714A0D7C9) placed as SogouComMgr.exe, and the DarkVigil implant as libcef.dll (SHA-1: 8A60A8E90E1F5F08F28FE5A6DD57BD686C20DC23). Whenever SGTool.exe invokes SogouComMgr.exe for component install or load operations (e.g., -invoke BizCenterComBundle BizCenterCom), it instead executes the Adobe binary, which side-loads the malicious libcef.dll. No separate persistence mechanism is needed: the implant hijacks Sogou's own component management workflow (T1574.001, T1036.005). - DarkVigil is a modular .NET toolset built on the Vigil framework, itself built on TouchSocket and its Duplex Message Transport Protocol (DMTP). DMTP operates over TCP, UDP, HTTP, WebSocket, or named pipes, identified by the magic header bytes "dm". Plugins are pushed from C2, stored compressed in the registry key HKCU\Software\Microsoft\IME\<HWID>\pluginHash (T1112), then decompressed, loaded into the .NET runtime, and executed. Each plugin establishes its own indirect DMTP channel back to C2 via the implant as relay, with a PluginID built from ProtocolType, HWID, controlerID, randomID, and PluginName (e.g., "Pillager"). Bootstrap domains include blog.wangmengfun[.]top, update.mssproxy[.]net, and img.fusfun[.]top. Staging/hijacking infrastructure includes 47.236.254[.]159 at dev.soft-png-cdn[.]com and sogou-cdn[.]com. Practitioner takeaway: Hunt for SGTool.exe spawning unexpected child processes or making outbound HTTP connections to any host other than Tencent-owned infrastructure. Check the Sogou Components directory for biz_helper.exe masquerading as SogouComMgr.exe and for an unsigned libcef.dll. Query HKCU\Software\Microsoft\IME for subkeys matching a HWID pattern containing a pluginHash value: compressed plugin binaries stored there are a strong indicator of active DarkVigil deployment. Verify DNS resolution history for config.pinyin.sogou[.]com in network logs and DNS cache artifacts. The full IOC list and samples are in ESET's GitHub repository. Update Sogou Input Method to version 16.10 or later, which migrates the affected requests to HTTPS with certificate pinning, closing the hijack surface. #DFIR_Radar
