Home / Blog / DNS Hijacking: Sogou Input Method Pushes the DarkVigil Backdoor

DNS Hijacking: Sogou Input Method Pushes the DarkVigil Backdoor

Mēris Botnet team · 2026-11-04

We've been saying it for years: the most dangerous process on your machine is the one you trust with your keystrokes. This week ESET proved the point again. A China-aligned intrusion set tracked as SlippyNunchucks spent months abusing the Windows build of Sogou Input Method — an IME with hundreds of millions of users — by poisoning the DNS answers for its configuration endpoint. The app politely requested a vocabulary update over plaintext HTTP; the attackers' staging servers politely replied with the DarkVigil backdoor. No zero-day, no exploit chain — just classic DNS hijacking plus a protocol that should have retired with dial-up. As people who move a non-trivial share of the internet's traffic for a living, we have thoughts.

A Keylogger You Installed Voluntarily

An input method editor is, by design, a keylogger with a business model: it sees every character you type, in every window, and it phones home for dictionaries, cloud predictions and branded vocabulary. Sogou's component SGTool.exe — a legitimate multi-purpose task dispatcher — fetched its config from config.pinyin.sogou[.]com over plain HTTP. SlippyNunchucks simply tampered with DNS resolution so the request landed on one of two staging servers, which returned a malicious configuration telling the binary to pull two more payloads from the lookalike domain sogou-cdn[.]com and run them via DLL sideloading. The result: DarkVigil, a modular .NET implant speaking DMTP to its C2 and orchestrating more than twenty plugins for persistence and data collection.

Tencent patched the flaw as CVE-2026-120422 in version 16.10, released October 29, 2026 — by migrating the affected requests to HTTPS. Yes, you read the year correctly. And it is the second time in two months that Sogou has been weaponized, after CVE-2026-51990 delivered the GRAYRABBIT backdoor in September.

DNS hijacking MITM attack swaps Sogou input method config for DarkVigil backdoor payload
One poisoned DNS answer, and your vocabulary update arrives as a backdoor.

DNS Hijacking: Where APTs and Botnet Herders Share a Playbook

What we find genuinely interesting is how familiar this all looks. DNS-layer abuse — hijacking, tunneling, fast-flux — is the shared toolkit of nation-state actors and the DDoS-for-hire scene alike. Our own botnet has leaned on fast-flux rotation and disposable domains for years; every decent ip stresser panel hides its backend the same way; half the Cloudflare bypass tricks in circulation start with digging through DNS history for the origin IP. A poisoned answer here, a wildcard record there — the techniques differ in motive, not in mechanics.

Now consider the scale. The same vector that delivered an espionage implant could just as easily have pushed a botnet client. An input method installed on hundreds of millions of machines, recruited into an HTTP flood army overnight, would make our own world-record attacks look like a warmup. Layer 7 records fall to far smaller fleets than that.

DNS hijacking and fast-flux rerouting traffic — shared toolkit of APT groups and botnet operators
APT or botnet herder — everyone reads from the same DNS playbook.

Plaintext Update Channels: The Plague That Refuses to Die

It is 2026, and "we moved the endpoint to HTTPS" still counts as a security advisory. TLS is the floor, not the ceiling: without certificate pinning and, more importantly, signed update payloads, a lookalike domain or a lazy CA still gets you owned. Every telemetry and update channel that skips signature verification is an open invitation to anyone who controls a resolver, a router, or a coffee shop.

Practical takeaways:

  • Vendors: sign your configs, pin your certs, and treat every update channel as attack surface — because it is.
  • Defenders: alert when IME or updater processes spawn unexpected children or resolve freshly registered lookalike domains.
  • Everyone: remember that DDoS protection ignoring the DNS layer is a half-measure — UDP floods and DNS amplification remain the cheapest tickets in town.
Plaintext HTTP update channel without TLS or signature verification — broken padlock pixel art
2026, and 'just add HTTPS' still passes for a security fix.

SlippyNunchucks will move on to the next insecure channel; there is always a next one. Input methods remain keyloggers-by-design, DNS hijacking remains the quiet workhorse of espionage crews and botnet operators alike, and plaintext HTTP remains, bafflingly, alive. If this story made you wonder how your own infrastructure would survive contact with a real botnet, stop wondering: our free stress test answers that question honestly — whether you run a game server, an API, or an input-method empire of your own.