On 1 July 2026, ESET began seeing DarkVigil implants launched by SGTool.exe, a legitimate Sogou Input Method component that fetched 20 configuration endpoints over plain HTTP. The contradiction is stark: the malicious configuration was encrypted, hash-consistent and structurally valid, so the only broken assumption was that the response came from the vendor.
In this article
Why this matters
This is not a browser exploit, a memory-corruption bug or a malicious update signed by the vendor. It is a failure of transport trust in a configuration channel that a widely deployed input method uses during normal operation, and it produced arbitrary code execution on Windows endpoints in a surveillance campaign that ESET says began on 1 July 2026 against organizations and Chinese-speaking individuals in Hong Kong, Thailand, Japan, Vietnam, Oman and Sri Lanka (ESET Research).
The affected product is narrow — the Windows build of Sogou Input Method (Sogou Pinyin) below version 16.10 — but the consequence is broad. The delivered implant, DarkVigil, is a modular .NET surveillance toolset with more than 20 known plugins, a plugin-push command-and-control channel over the Duplex Message Transport Protocol (DMTP), and a web administration panel used to manage exfiltrated data (ESET Research).
The defensive lesson is also specific. The assumption that failed was not "a checkbox was missing" but that a configuration response arriving over HTTP from a resolvable hostname was authentic. Once DNS answers can be substituted, the vendor's own encryption and hash fields become attacker-controlled rather than protective, because the attacker sets the hash values to match the payloads being delivered (Brandefense).
What happened
In a clean environment, SGTool.exe requests config.pinyin.sogou[.]com/api/brandScd/getBrandScd.php as part of the branded vocabulary promotion mechanism. In the observed attack, DNS resolution for that domain was manipulated so the request landed on one of two attacker staging servers, 47.239.250[.]102 (associated with sogou-cdn[.]com) and 47.237.122[.]175 (associated with dev.soft-png-cdn.com) (The Hacker News).
The malicious configuration names two downloads: a legitimate, signed Adobe Licensing WF Helper renamed biz_helper.exe, and the DarkVigil implant named libcef.dll. The Adobe binary serves as the loader, and the implant is loaded through DLL side-loading. ESET describes two mutually exclusive execution paths: in one, the Adobe binary replaces SogouComMgr.exe, so any Sogou component command launches the attacker helper and loads the implant, which also provides persistence; in the other, the files are written under the biz_center component folder and execute when SGTool.exe invokes the BizCenterCom bundle (Brandefense).
ESET notes both methods are highly destructive and likely to cause software failures. That gives defenders a behavioral tell: a Sogou component that suddenly crashes or reinstalls itself may be a visible side effect of compromise rather than a benign update problem (Brandefense).
Post-exploitation, DarkVigil operates as a modular .NET toolset built on the Vigil framework and the TouchSocket networking library. ESET identifies two implant forms, libcef.dll detected as Win64/Agent.KSV and a .NET implant detected as MSIL/DarkVigil_AGen.D. The command channel uses DMTP, which can run over TCP, UDP, HTTP, WebSocket and named pipes; the server pushes a plugin via DMTP file transfer, the implant stores the compressed plugin in the registry under HKCU\Software\Microsoft\IME followed by a hardware identifier, and then runs it (Brandefense).
The disclosure sequence was fast. ESET reported the weakness to Tencent Security on 11 September 2026, Tencent acknowledged it on 21 September, and version 16.10 shipped in late October 2026, moving the affected requests to HTTPS. ESET's disclosure timeline dates the fix to 30 October, while The Hacker News and InfraStack cite 29 October. ESET, acting as CNA, issued CVE-2026-120422 on 2 November, and ESET published its research on 4 November (ESET Research).
| Claim | Status | Basis |
|---|---|---|
| Sogou below 16.10 fetched configuration over plain HTTP, enabling code execution via substituted responses | Confirmed | ESET Research; CVE-2026-120422 |
| The campaign was exploited in the wild from 1 July 2026 | Confirmed | ESET Research; InfraStack live feed |
| Version 16.10 moves affected requests to HTTPS | Confirmed | ESET Research; The Hacker News; Brandefense |
| Fix released 29 October 2026 | Reported | The Hacker News; InfraStack |
| Fix released 30 October 2026 | Reported | ESET Research disclosure timeline |
| DNS manipulation occurred via compromised routers, router implants or ISP-level interception | Inferred | ESET lists these as suspected possibilities |
| The exact point at which DNS was manipulated | Not established | ESET states it remains unknown |
| Earliest affected Sogou version | Not established | Not stated in the available material |
| SlippyNunchucks is a distinct China-aligned nation-state surveillance effort | Company statement | ESET assessment, high confidence |
| SlippyNunchucks is Mustang Panda | Not established | ESET found no tactical overlap in telemetry |
| Affected requests lacked TLS rather than bypassing certificate validation | Confirmed | ESET; Brandefense; Aviatrix wording requires care |
Limits of the record
Several boundaries matter for anyone planning a response. The earliest affected version is not stated, so "older than 16.10" is the operative boundary rather than a specific introduction version. The point at which DNS manipulation occurs remains unknown: ESET explicitly lists compromised routers with modified DNS settings, routers running an implant that hijacks DNS requests, and ISP-level interception as suspected possibilities, while stating the actual mechanism was not determined (InfraStack).
Two characterizations in secondary coverage need correction rather than repetition. Aviatrix's description of the request being made "with no certificate validation" should be read as the absence of TLS on the affected request, not a certificate-validation bypass on an HTTPS channel. Separately, Aviatrix lists CVE-2021-38003, a Chromium V8 type-confusion flaw, as part of the Sogou attack surface, tied to a separate UNC3569 GRAYRABBIT delivery chain against Sogou's embedded CEF-based WebView. That is a different campaign and a different mechanism, and it does not change the exposure assessment for CVE-2026-120422, which requires no browser exploit at all (Aviatrix).
Attribution also carries a caveat. ESET assesses with high confidence that SlippyNunchucks is a distinct China-aligned nation-state surveillance effort aligned with Chinese government interests, and explicitly rejects the earlier public attribution of DarkVigil to Mustang Panda because its telemetry shows no tactical overlap. Operationally, defenders should not assume Mustang Panda hunting rules, indicators or infrastructure will surface this activity (The Hacker News).
Defensive priorities
The immediate sequence is inventory, upgrade, triage. Confirm the installed Sogou version through the application's About dialog or the Windows Apps list; anything below 16.10 needs updating. Machines without Sogou installed, or already on 16.10 or later, are not exposed to this path (InfraStack).
Because the campaign ran from 1 July 2026 and the fix landed in late October, a version check alone cannot establish that a host is clean. Systems that were exposed during that window warrant host triage: look for SGTool.exe under C:\Program Files (x86)\SogouInput<version>, for DNS or proxy logs showing config.pinyin.sogou.com resolving to 47.239.250.102 or 47.237.122.175, and for any contact with sogou-cdn.com. The registry path HKCU\Software\Microsoft\IME followed by a hardware identifier is where pushed plugins are stored, and the presence of biz_helper.exe or an unexpected libcef.dll in Sogou component directories is worth investigating (InfraStack).
Network-side controls matter because the attack requires either DNS control or interception of the network path. Enforcing encrypted transit for application configuration, monitoring egress to the named staging servers, and watching for Sogou components that crash or reinstall themselves all narrow the window. The broader lesson is that any application still retrieving configuration or update metadata over plain HTTP should be treated as a candidate for the same pattern, because the attacker in this case needed no exploit, no memory corruption and no user interaction beyond the application performing its normal fetch (ESET Research).
Method and sources
This analysis draws on ESET Research's primary technical write-up of the SlippyNunchucks operation and DarkVigil, The Hacker News's 4 November 2026 coverage, Aviatrix's threat research brief, InfraStack's live CVE record for CVE-2026-120422, and Brandefense's summary of the ESET findings. Where those sources disagree — the 29 versus 30 October fix date — both readings are recorded rather than reconciled. Claims are labelled by evidentiary status: ESET's actor assessment and Tencent's fix are treated as company statements, the exploitation timeline as confirmed by ESET telemetry, the interception mechanism as inferred, and the earliest affected version and precise DNS manipulation point as not established. No public exploit was listed on GitHub in the InfraStack record, and the 30-day EPSS figure recorded there was 0.4% (InfraStack).