Sogou Input Method: DNS-hijacked plaintext config fetch deploys DarkVigil backdoor (CVE-2026-120422)
Severity: high · Patch status: patched · Since 2026-11-04 · CVE-2026-120422
ESET attributes this campaign to SlippyNunchucks, a China-aligned actor that deploys the DarkVigil (FDMTP) .NET backdoor and has been active since at least 2023-09-15; ESET found no overlap with Mustang Panda. From 2026-07-01, the actor redirected DNS for config.pinyin.sogou.com to attacker-run staging servers. The Sogou Input Method helper SGTool.exe fetches its brand configuration over plaintext HTTP, so a forged response told it to download a legitimate signed Adobe helper renamed bizhelper.exe and a malicious libcef.dll; DLL sideloading then ran the implant. ESET does not identify where the DNS answer was altered and lists router compromise or ISP interception as possibilities. Reported victims include organisations and individuals in Hong Kong, Thailand, Japan, Vietnam, Oman and Sri Lanka, among them online gambling operators. Tencent released Sogou IME 16.10 on 2026-10-30 (ESET gives 29 or 30 October in different places), moving these requests to HTTPS. CVE-2026-120422, assigned by ESET as CNA, describes the plaintext configuration fetch; NVD had no CVSS score at last check. CVE-2026-51990 is a separate, earlier bizhelper.exe bug fixed in 16.3.0.3498. ESET also ties an earlier QuickFox VPN supply-chain compromise to the same actor; secondary coverage dates Fortinet's report to August 2026.
What to do
- Update Sogou Input Method on Windows to version 16.10 or later immediately (the fix moves the config request to HTTPS)
- Hunt DNS and proxy logs for config.pinyin.sogou[.]com resolving to anything other than Sogou infrastructure, and for connections to 47.239.250.102, 47.237.122.175 and 47.86.15[.]162, and to sogou-cdn[.]com, blog.wangmengfun[.]top, update.mssproxy[.]net and img.fusfun[.]top
- Audit endpoints for sideloading of libcef.dll and biz_helper.exe beside Adobe binaries, especially \Components\SogouComMgr.exe, \Components\libcef.dll and SGTool.exe activity; ESET's libcef.dll SHA-1 is 8A60A8E90E1F5F08F28FE5A6DD57BD686C20DC23
- Enforce HTTPS/HSTS and DNS integrity monitoring for internal use of Chinese-language applications
- Review QuickFox installs against the vendor's clean release; ESET ties an earlier QuickFox supply-chain compromise to the same actor
Fixed versions
Sources
All live incidents on Threat Watch
