DNS Security
DNS Security Alert: Nobody Needed to Steal the Domain
By Nattapong Sukkasem · Published · Updated .
TL;DR — ESET Research published an analysis on 4 November showing that a China-aligned group it tracks as SlippyNunchucks delivered the DarkVigil backdoor to users of Sogou Input Method, the Tencent-owned Chinese-language keyboard, by tampering with the DNS resolution of a single Sogou hostname. The component fetched its configuration over plain HTTP, so controlling the answer to one name query was enough to control what the software downloaded and where it wrote it on disk. Tencent closed the hole in version 16.10 by moving the request to HTTPS. The DNS security lesson is the uncomfortable part: no domain was stolen, no certificate was forged, and ESET still cannot say where on the path the lookup was answered.
A name query is a question, and until something further down the stack checks the reply, whoever answers first decides what your software does next. That is the whole of this week's most instructive DNS security story. ESET Research described a campaign running since 1 July 2026 in which a legitimate, correctly registered Tencent hostname resolved — for selected victims only — to a server the attacker controlled. Nothing was taken over at the registrar. No certificate was forged, because the request that followed the lookup carried no TLS at all. Everything after that followed from one answer to one question.
What ESET published, and when
The research went out on 4 November from ESET's Bratislava and Montreal offices, authored by researcher Anh Ho. The disclosure timeline in it is short and clean: ESET notified Tencent Security on 11 September, Tencent acknowledged the report on 21 September, and a fixed build landed at the end of October. ESET, acting as a CVE Numbering Authority, issued CVE-2026-120422 on 2 November for the Windows editions below 16.10.
Carry one small hedge: ESET's own campaign overview dates version 16.10 to 29 October while its technical section and timeline say 30 October, and Sogou's release log supports the later date. Nothing turns on the day, but it is the kind of discrepancy worth noticing before you quote it in a change ticket.
How a plain HTTP request became a backdoor
The abused component is SGTool.exe, which ESET describes as a multipurpose task dispatcher inside Sogou Input Method with at least thirty command identifiers. Invoked as --appid=scdreg -update, it fetches the configuration that tells the keyboard which icons to download for branded cell dictionaries — a marketing feature dating to 2016. The request goes to config.pinyin.sogou[.]com/api/brandScd/getBrandScd.php, and ESET counted twenty endpoints on that host reached over unencrypted HTTP.
| Step | What happens |
|---|---|
| Ask | SGTool.exe resolves config.pinyin.sogou[.]com to collect its branded-icon configuration |
| Answer | The lookup returns 47.239.250[.]102 or 47.237.122[.]175, staging hosts behind sogou-cdn[.]com |
| Fetch | The request leaves over plain HTTP, so no certificate is offered and none is checked |
| Swap | The staging host returns a configuration whose md5 fields match the attacker files, satisfying the integrity check |
| Place | Two downloads land inside Sogou's own component folder: a signed Adobe helper renamed SogouComMgr.exe and a rogue libcef.dll |
| Run | The next time SGTool calls its component manager, the Adobe binary runs and side-loads libcef.dll, starting DarkVigil |
That last row is the step most secondary coverage leaves out, and it is the elegant part. The attacker wrote no service, no scheduled task and no registry run key. The configuration merely nominates destination paths, and Sogou's existing component-loading workflow does the executing. ESET notes a second variant that drops the payloads into a versioned biz_center directory the dispatcher invokes routinely. Only one route can be live at a time, and both are destructive enough to risk breaking the application.
DarkVigil itself, also reported as FDMTP, is a modular .NET implant with more than twenty plugins, a web administration panel and a command channel built on the DMTP transport. It is not quiet. It simply never had to be, because nothing about the delivery looked abnormal.
The question nobody can answer: where the lookup was answered
ESET is direct about the gap. The point at which the DNS manipulation occurred remains unknown, and the report calls the delivery an undiscovered method. The candidates offered are routers with modified DNS settings, routers carrying an implant, and interception further upstream at an internet provider. The victim spread across six territories argues against a single compromised network, and the researchers initially suspected a software exploit purely because of how widely the implants landed. That unknown is the fact this DNS security story turns on, because an attack you cannot locate is an attack you cannot scope.
Notice what that does to your inventory. Most teams track server infrastructure as the machines they operate. This campaign never touched one of those. The machines that mattered were two rented staging hosts and whatever box, somewhere between a user's keyboard and a Tencent data centre, decided to answer a question that was not addressed to it.
It is also worth being precise about the words. There is no zero-day vulnerability here in the sense most readers assume, because nothing in the software was defeated. The CVE records an absence rather than a defect: a request that should have been encrypted was not. An attacker who can answer your name queries does not need a memory-corruption bug when the client will accept whatever arrives in plaintext.
Who was targeted, and by whom
ESET places victims among organisations and Chinese-speaking individuals in Hong Kong, Thailand, Japan, Vietnam, Oman and Sri Lanka, with occasional reach into Germany, Russia, the United Kingdom and Austria. The standouts are a multinational gambling operator working across Sri Lanka, the Philippines and Hong Kong, an internet cafe in Dubai and a university student in Denmark. No victim count was published.
Attribution is given with high confidence as a nation-state surveillance effort aligned with Chinese government interests, under the name SlippyNunchucks, active since at least 15 September 2023. One disagreement is worth carrying at full strength: other researchers have linked the DarkVigil toolset to Mustang Panda, and ESET says its own telemetry shows no overlap and treats SlippyNunchucks as a distinct intrusion set.
What 16.10 fixes, and what it leaves open
The fix migrates the affected requests to HTTPS and enforces certificate validation; ESET's technical section also describes certificate pinning. That is the right repair, and it is worth seeing why: it does not make the lookup trustworthy, it makes a false answer useless. The client now notices that the host at the other end cannot prove it is Tencent.
ESET flags what remains. The downloader still does not validate the type of the files it retrieves, nor restrict where they may be written. Both staging hosts sat in commercial Alibaba Cloud ranges, which is its own small lesson in cloud security: the usual framing assumes you are the tenant whose data is at risk, and here the adversary was the tenant, renting ordinary capacity in a region nobody would block.
What to do this week
- Move Sogou Input Method to 16.10 or later on every Windows endpoint carrying it, and remember that the Android and iOS editions were not shown to share the flaw, which is not the same as being cleared.
- Hunt the published indicators. ESET lists the staging addresses above plus
dev.soft-png-cdn[.]com, bootstrap hostsblog.wangmengfun[.]top,update.mssproxy[.]netandimg.fusfun[.]top, the implant hash8A60A8E90E1F5F08F28FE5A6DD57BD686C20DC23, and a plugin cache underHKCU\Software\Microsoft\IME. - Resolve the names yourself and compare. A lookup that returns the same answer from your resolver, a public resolver and a client subnet tells you more than any single query does. Use a network diagnostic tool to pull current records before you touch a single endpoint.
- Check how old the look-alike hostnames are. The payload domains in this campaign were first seen weeks before the implants appeared, and a WHOIS lookup on any suspicious host in your logs will usually separate a long-lived service from something registered for a campaign.
- Search proxy and firewall logs for plaintext HTTP from desktop software. Not browsers — installers, updaters, keyboards, media tools. Anything fetching configuration on port 80 is accepting whatever your resolver was told.
- Produce the list of applications that phone home for configuration, with the hostnames each one uses. Give it a deadline this month. That list is the IT security artefact this campaign actually demands, and it is far cheaper to build now than during an incident.
Resolution is not authentication
It is tempting to file this under encryption, and to say that DNS over HTTPS would have prevented it. That is half true, and the half that is false matters more. Encrypting the query protects it from tampering between the client and the resolver it chose. It says nothing about whether that resolver told the truth, and nothing at all if the device doing the resolving is the device under the attacker's control. DoH authenticates who you asked. It does not authenticate the answer.
Consider also where this landed. A DDoS attack arrives at infrastructure you own, where you have graphs, budgets and an on-call rotation. This arrived at equipment you do not own, cannot monitor and will never patch: a home router, a cafe gateway, a provider's resolver three hops away. The defensive surface was somebody else's entirely.
The durable point of this DNS security story is that resolution was never an authentication mechanism and was never meant to be one. For decades the industry has compensated by authenticating what comes after the lookup, which is exactly what TLS is for. Sogou skipped that step on twenty endpoints of one hostname, and a nation-state operator found it. Every application you run makes the same bargain somewhere. The only question is whether anything downstream is still checking.
Sources
- ESET Research — SlippyNunchucks hijacks the Sogou Input Method brand promotion mechanism to distribute malware
- ESET — China-aligned SlippyNunchucks hijacks a language app to distribute malware abroad
- The Hacker News — China-aligned hackers hijack Sogou Input Method DNS requests to deploy the DarkVigil backdoor
- Infosecurity Magazine — China-aligned group abuses Sogou Input Method to deliver malware
- Gridinsoft — Sogou icon request hijacked to deliver DarkVigil
- EuropaWire — ESET says SlippyNunchucks abused Sogou Input Method to spread DarkVigil through DNS hijacking
Related articles
Browse every DNS news article by month →
DNS angle
Review resolver logs for the systems discussed above and compare unexpected names with your approved services. A successful lookup does not establish that a destination is safe. Use the DNS lookup tool to inspect current answers, then compare them with your own resolver and incident records.