China-aligned group abuses Sogou Input Method to deliver DarkVigil backdoor
- Severity
- High
- Highest CVSS
- 8.9
- Exploited
- Not known
- Sources
- 1
What happened
SlippyNunchucks (tracked by ESET, which does not link it to Mustang Panda) abused a plain-HTTP request from Sogou Input Method's SGTool.exe to config.pinyin.sogou[.]com via DNS hijacking, returning a forged brand-promotion config that pulled a signed Adobe Licensing WF Helper (renamed bizhelper.exe) and a malicious libcef.dll (DarkVigil/FDMTP) with spoofed checksums. The loader persisted as SogouComMgr.exe with a backup in a bizcenter folder. Tencent fixed the issue in 16.10 (CVE-2026-120422). Update to 16.10 or later, check router DNS settings, and hunt for connections to the listed bootstrap and staging infrastructure and odd Adobe-named files in Sogou's Components folder.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Update Sogou Input Method to version 16.10 or later.
- Check router DNS settings for signs of tampering.
- Look for connections to the listed DarkVigil domains and IP addresses in your logs.
- Search Sogou's Components folder for unexpected Adobe-named files.
Written by AI from the sources, checked against them
Vulnerabilities
Full story timeline · 2 updates
Who reported · 1 outlet
Who and what is in it
Threat actors
Malware
Products