SlippyNunchucks APT Abuses Sogou App via DNS Hijacking

Executive Summary

ESET Research has uncovered a surveillance campaign conducted by a China-aligned Advanced Persistent Threat (APT) group known as SlippyNunchucks. The group is abusing the widely-used Sogou Input Method editor, a product of Tencent, to distribute its DarkVigil malware. The attack leverages a vulnerability, now tracked as CVE-2026-120422, where the application used insecure HTTP for updates. By performing DNS hijacking, SlippyNunchucks was able to intercept a request from the application's SGTool.exe component and serve a malicious configuration file, leading to malware deployment. The campaign has targeted organizations and Chinese-speaking individuals across Asia and Europe. In response to ESET's findings, Tencent has patched the vulnerability in version 16.10 of the application.

Threat Overview

The threat actor, SlippyNunchucks, is a China-aligned group focused on cyber-espionage. Their primary tool in this campaign is the DarkVigil malware ecosystem. The attack targets users of the Sogou Input Method (also known as Sogou Pinyin), one of the most popular Chinese input method editors (IMEs) for Windows.

Attack Vector: The core of the attack is a Man-in-the-Middle (MitM) technique combined with a software supply chain-style abuse:

1. DNS Hijacking: The attacker gains control over the victim's DNS resolution, likely through compromising a network device (e.g., a router) or other means.
2. Insecure Communication: The Sogou application's SGTool.exe component made a request over unencrypted HTTP to check for vocabulary promotions.
3. Malicious Redirect: Due to the DNS hijacking, this HTTP request is redirected to an attacker-controlled server.
4. Payload Delivery: The attacker's server responds with a malicious configuration file, which instructs the application to download and execute the DarkVigil malware.

This method is particularly insidious as it abuses a legitimate, signed application from a trusted vendor to deliver malware, making it less likely to be flagged by basic security controls.

Technical Analysis

The vulnerability, CVE-2026-120422, exists in versions of Sogou Input Method prior to 16.10. The flaw is the use of HTTP instead of HTTPS for a specific update check. This lack of encryption and certificate validation allows for the DNS hijacking attack to succeed. If HTTPS had been used, the application would have rejected the connection to the attacker's server due to an invalid TLS certificate, thwarting the attack.

The campaign demonstrates the following MITRE ATT&CK techniques:

• T1557 - Man-in-the-Middle: The overarching technique, specifically through DNS hijacking, to intercept and manipulate the application's network traffic.
• T1199 - Trusted Relationship: Abusing the inherent trust users have in the legitimate Sogou application to deliver a malicious payload.
• T1204.002 - Malicious File: Tricking the user's system into executing malware by serving a malicious configuration file through the trusted application.

Impact Assessment

The primary goal of the SlippyNunchucks group and its DarkVigil malware is surveillance and intelligence gathering. Victims have been identified in Hong Kong, Thailand, Japan, Vietnam, Oman, and Sri Lanka, indicating a broad geographic focus. The impact on targeted organizations and individuals includes the theft of sensitive information, intellectual property, and personal data. By hijacking a ubiquitous application like Sogou Pinyin, the attackers can achieve widespread access within their target demographic (Chinese-speaking users).

Cyber Observables — Hunting Hints

The following patterns may help identify vulnerable or compromised systems:

Detection Methods

• Software Inventory: Identify all systems running Sogou Input Method and check if the version is below 16.10. These systems are vulnerable and should be prioritized for patching.
• Network Monitoring: Implement HTTPS inspection where possible. For unencrypted traffic, create detection rules in your firewall or IDS/IPS to alert on HTTP traffic from SGTool.exe.
• DNS Monitoring: Analyze DNS logs for signs of hijacking. Tools that monitor for changes in DNS resolutions for critical domains can be effective.

Mitigation

• Update Software: The most effective mitigation is to update Sogou Input Method to version 16.10 or later. Tencent has fixed the vulnerability by migrating the affected communication channel to HTTPS.
• DNS Security: Use a trusted, secure DNS resolver (e.g., DNS over HTTPS or DNS over TLS) to make DNS hijacking more difficult.
• Network Egress Filtering: Restrict outbound HTTP traffic from endpoints where possible, favoring encrypted HTTPS communication.