Summary of the incident and immediate impact
ESET researchers uncovered a targeted campaign by the China-linked APT group SlippyNunchucks that abused an insecure Sogou Input Method (Sogou Pinyin) Windows component to deliver the DarkVigil malware ecosystem. The attackers exploited unencrypted HTTP requests from the legitimate SGTool.exe process to perform DNS hijacking and serve malicious configuration files. That configuration instructed the application to place payloads into trusted locations so the SGTool.exe component would execute them, effectively using the product’s own workflows to run implants.
How the vulnerability was exploited: technical sequence
The exploitation chain followed these concrete steps:
1) Identify insecure HTTP endpoint: Sogou Input Method made certain requests over plain HTTP to fetch a word-promotion configuration. The attackers intercepted or poisoned DNS responses for those domains.
2) DNS hijack or PoC response: By controlling DNS resolution for target victims, the group redirected requests to attacker-controlled servers that returned crafted configuration files.
3) Malicious configuration instructions payload placement: The supplied configuration directed SGTool.exe to write binaries to specific filesystem locations that the legitimate process would later load or execute.
4) Execution via legitimate component: SGTool.exe — a multipurpose task distributor — then invoked those binaries, launching DarkVigil implants without triggering typical suspicious behaviors tied to unknown executables.
Who was targeted and geographic spread
SlippyNunchucks focused on organizations and Chinese-speaking individuals across Asia, with confirmed targets in Hong Kong, Thailand, Japan, Vietnam, Oman, and Sri Lanka. Telemetry also indicates the operation reached users in other Asian and European countries, including Germany, Russia, the United Kingdom and Austria. Target selection shows a primary regional focus with opportunistic expansion into Europe.
DarkVigil (FDMTP) toolkit: components and capabilities
DarkVigil, tracked by ESET as FDMTP, is a modular implant ecosystem. Notable elements include:
Implants: Persistent executables that collect system metadata, enumerate files, and exfiltrate data.
Delivery helpers: Use of SGTool.exe as a trusted loader reduced detection windows because the workflow leveraged normal product behavior.
Command-and-control and management panel: ESET discovered a web management interface bearing the Vigil name and logo that operators used to manage implants and collect stolen data.
Why HTTPS and certificate validation would have blocked the attack
The root cause enabling DNS hijacking was the use of unencrypted HTTP for configuration retrieval. When an application uses HTTP, DNS-level redirection or man-in-the-middle attacks can replace legitimate responses with attacker-controlled files. By updating the application to fetch configurations over HTTPS and performing TLS certificate validation, Tencent eliminated the ability for remote actors to trivially spoof configuration files via DNS manipulation. The patched Sogou Input Method 16.10 enforces HTTPS for the affected requests, making the same DNS hijack technique ineffective unless attackers also break TLS (which raises complexity and risk of detection).
Indicators of compromise (IoCs) and what to look for
Search for the following behaviors to detect similar exploitation:
Network indicators: Unexpected HTTP requests from SGTool.exe to domains that previously used secure endpoints; DNS responses that resolve Sogou-related domains to unusual IP addresses; connections to C2 hostnames or IPs associated with DarkVigil.
Host indicators: New binaries written to Sogou-relevant directories or locations referenced in configuration files; SGTool.exe spawning or loading unsigned executables; persistence mechanisms tied to SGTool.exe workflows.
Telemetry signatures: Sudden telemetry clusters showing SGTool.exe performing file placement or execution steps outside normal update/maintenance routines.
Step-by-step mitigation and detection guidance for organizations
Follow these prioritized actions to reduce exposure and detect compromise quickly:
1) Patch immediately: Ensure Sogou Input Method is updated to version 16.10 or later on all Windows hosts.
2) Enforce network protections: Block or monitor outbound HTTP requests from SGTool.exe and other input-method processes. Implement DNS filtering and DNSSEC validation where possible.
3) Monitor SGTool.exe behavior: Alert on SGTool.exe making network calls to unexpected hosts, writing binaries to non-standard locations, or spawning new child processes that are not signed by Tencent.
4) Validate TLS and certificate pinning: Prefer secure configuration retrieval. Where possible, implement application-layer validations for critical configuration files.
5) Hunt for DarkVigil artifacts: Use EDR/AV tools to search for recently written executables in Sogou-related folders, check for communications to known C2s, and review web panel access patterns if you operate honeypots.
Attribution and operational context
ESET links the campaign to SlippyNunchucks, an APT that has used DarkVigil since at least early 2025. While some public reports previously attributed DarkVigil to Mustang Panda (aka Twill Typhoon), ESET telemetry found no overlap between Mustang Panda activity and the DarkVigil operations observed — supporting separate attribution. SlippyNunchucks appears to maintain persistent operations focused on Chinese-speaking victims in South and East Asia and conducts opportunistic targeting in Europe.
Practical example: a realistic detection playbook
Example workflow for a SOC investigating potential abuse of SGTool.exe:
Step A — Triage: Query EDR for recent SGTool.exe network activity. Prioritize hosts where SGTool.exe performed plain-HTTP GETs.
Step B — Correlate DNS: For those hosts, extract DNS query/response logs and verify whether Sogou-related domains resolved to unusual IPs during the timeframe of suspicious activity.
Step C — File system inspection: Inspect directories where configuration-driven writes occur; Compare hashes of any newly written binaries to known good vendor hashes or cloud-scan databases.
Step D — Containment: Isolate affected endpoints, block outbound access to identified C2 IPs, and preserve memory and disk images for forensic analysis.
Step E — Remediation: Remove malicious files, restore affected components from known-good vendor packages, and revalidate TLS certificate chains for any remaining network traffic.
How vendors and users responded
After ESET declared the findings to Tencent Security Response Center, Tencent issued a patch that upgraded the affected configuration endpoint requests to HTTPS in Sogou Input Method 16.10. That change enforces TLS certificate validation and prevents trivial DNS poisoning from serving attacker-controlled configurations. Users should apply that update immediately; enterprise administrators should deploy it centrally and verify no legacy versions remain in their environment.
Broader lessons and prevention strategies
This incident highlights two repeatable lessons:
1) Avoid plain HTTP for configuration or control channels: Any unauthenticated or unencrypted control retrieval enables trivial abuse via DNS manipulation.
2) Treat third-party helper components as high risk: Legitimate helper processes that accept remote configuration or execute plugins create a powerful abuse surface. Inventory and monitor them as rigorously as you monitor services that run with elevated privileges.
Further reading and tracking
Security teams monitoring APT activity should combine vendor telemetry (ESET’s report) with network DNS monitoring and threat intelligence feeds that list DarkVigil C2s and IoCs. Maintaining an updated inventory of input-method software and enforcing update policies for widely deployed third-party utilities will reduce the likelihood of similar successful campaigns.
Be the first to comment