Originally published on satyamrastogi.com

SlippyNunchucks weaponizes Sogou Input Method DNS hijacking to deploy DarkVigil backdoor. Campaign targets organizations via insecure HTTP, enabling persistent surveillance and lateral movement.

Executive Summary

China-aligned threat actor SlippyNunchucks has conducted a targeted DNS hijacking campaign against Sogou Input Method (SIM) users, leveraging insecure HTTP communications in Windows versions to deploy DarkVigil (FDMTP) backdoor implants. The campaign commenced July 1, 2026, with assessments indicating organizational targeting across multiple verticals. This represents a sophisticated supply-chain adjacent attack vector where threat actors compromise legitimate IME infrastructure to establish persistent command-and-control (C2) channels with minimal detection surface.

The attack methodology exploits a fundamental architectural flaw: Sogou Input Method's reliance on unencrypted DNS and HTTP communications for dictionary updates, suggestion retrieval, and cloud input services. By performing DNS poisoning or network-level man-in-the-middle (MITM) interception, attackers redirect legitimate IME traffic to attacker-controlled servers hosting DarkVigil payloads.

Attack Vector Analysis

Initial Access & Compromise Chain

The attack sequence follows established MITRE frameworks:

  • Initial Compromise (T1499 - Network Denial of Service / T1584.004 - Compromise Infrastructure): Threat actors either compromise DNS infrastructure serving Sogou update servers or position themselves on victim networks via prior access (VPN, employee systems, ISP-level BGP hijacking).

  • Man-in-the-Middle (T1557 - Adversary-in-the-Middle): Unsecured HTTP requests from Sogou Input Method to update endpoints become interception points. IME applications typically run with user privileges, enabling direct code execution on workstations.

  • Payload Delivery (T1195.002 - Compromise Software Supply Chain / T1566.002 - Phishing - Spearphishing Link): DarkVigil binary is served in place of legitimate dictionary updates or cloud sync responses. User remains unaware due to silent background update mechanism.

  • Persistence (T1547.013 - Boot or Logon Autostart Execution): DarkVigil establishes registry-based or task scheduler persistence, executing on every Windows logon.

  • Command & Control (T1071 - Application Layer Protocol / T1001 - Data Obfuscation): Backdoor communicates to C2 infrastructure using encrypted or obfuscated channels, exfiltrating system information, credentials, and keystroke logs.

Why This Attack Succeeds

Input Method Editors occupy a privileged execution context on Windows systems. They operate at language/keyboard layer, processing all keyboard input before application-level filtering. This grants DarkVigil capabilities matching or exceeding user-mode rootkits without requiring kernel exploitation. Additionally:

  1. Trust Assumption: Users trust IME updates as system-critical. Sogou's market penetration in Chinese-speaking regions creates large target surface.
  2. HTTP Insecurity: Chinese IME vendors historically prioritize functionality over security. Unencrypted update channels remain standard practice.
  3. Detection Evasion: IME execution chains blend with legitimate system processes, complicating behavioral analysis.

Technical Deep Dive

DarkVigil Implant Characteristics

DarkVigil (FDMTP protocol variant) demonstrates capabilities consistent with state-sponsored surveillance tools:

Capability Matrix:

  • Keystroke logging with context windows (active application, URL, email recipient)
  • Screenshot capture at configurable intervals or event-triggered (clipboard changes, document save)
  • Credential harvesting from Windows DPAPI-protected storage, browser password managers, and cloud sync services
  • Process hollowing for lateral movement within enterprise networks
  • Reverse proxy capabilities enabling attacker-controlled traffic routing through compromised endpoint
  • C2 communication resilience via DNS-over-HTTPS (DoH) fallback and peer-to-peer mesh network propagation

Execution Flow:

[Sogou IME Background Process] | v [HTTP GET /cloud/update/dict_v3.bin] | v [Intercepted by DNS hijack/MITM] | v [Attacker server responds with DarkVigil PE] | v [IME process spawns child process, injects DarkVigil] | v [DarkVigil establishes C2, beacons to command infrastructure]

Network Indicators

Victims connecting to rogue Sogou servers exhibit:

  • DNS queries for sogou.com, sougou-inc.com resolving to attacker-controlled IPs (typically bulletproof hosting providers in APAC regions)
  • TLS certificate mismatches if HTTPS interception attempted (indicate proxy-based MITM)
  • HTTP User-Agent strings matching Sogou client versions but originating from non-Sogou IP address space
  • C2 traffic using port 443 with custom SSL certificates or HTTP/2 frames with irregular framing patterns

Detection Strategy

Network-Level Detection

  1. DNS Monitoring (MITRE T1040 - Traffic Capture):

    • Alert on DNS requests for sogou.com domains resolving to IPs outside known Sogou ASNs (AS136666, AS55990)
    • Correlate DNS NXDOMAIN responses followed by unexpected A record resolutions within 2-5 seconds (DNS hijack signatures)
    • Monitor for DNS query volume spikes from individual endpoints (C2 beaconing patterns)

  2. Proxy/Firewall Rules:

    • Flag HTTP traffic to Sogou infrastructure (should be HTTPS-only)
    • Block user agents matching Sogou versions known vulnerable to DarkVigil injection
    • Inspect for binary payloads in HTTP response bodies matching PE header signatures

Endpoint Detection

  1. Process Monitoring:

    • Alert on Sogou IME spawning child processes (legitimate updates occur in-process)
    • Detect DarkVigil registry persistence keys: HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\[RandomName]
    • Monitor Task Scheduler creation events with Sogou-related task names

  2. File Analysis:

    • Hash DarkVigil samples against YARA rules detecting FDMTP protocol headers in memory
    • Scan Sogou installation directories for unsigned or timestomped binaries
    • Monitor for .tmp or .dat files in AppData\Local\Sogou with recent modification times

  3. Behavioral Signals:

    • Sogou process accessing HKEY_LOCAL_MACHINE registry hives (requires privilege elevation)
    • Keystroke logging API calls (GetAsyncKeyState, SetWindowsHookEx) from IME context
    • Outbound DNS-over-HTTPS connections to non-standard DoH resolvers

SIEM Queries 

event_type:dns AND domain:*sogou* AND NOT ip_cidr:"AS136666/*" | stats count by src_ip, resolved_ip | where count > 50 event_type:process_create AND parent:"sougou.exe" AND NOT image:"*\\sougou\\*" | stats count by src_ip event_type:registry AND path:"*Winlogon*Notify*" AND NOT data:"*microsoft*" | stats count by user

Mitigation Guidance

Immediate Actions (24-48 Hours)

  1. Inventory & Isolation:

    • Identify systems with Sogou Input Method installed using asset management tools
    • Segregate affected endpoints to isolated VLAN for forensic analysis
    • Block outbound DNS queries for sogou.com at firewall level

  2. Network Hardening:

    • Enforce DNS security (DNSSEC validation, DNS filtering appliance deployment)
    • Redirect all HTTP Sogou traffic to transparent HTTPS proxy for inspection
    • Implement certificate pinning for known Sogou update endpoints

Short-Term (1-2 Weeks)

  1. Uninstall & Re-deployment:

    • Remove Sogou Input Method from all enterprise endpoints
    • Deploy alternative IMEs (Microsoft Pinyin, Google Pinyin) or enforce single authorized IME via Group Policy
    • Verify clean state via full disk image forensics before re-provisioning

  2. Credential Rotation:

    • Force password reset for all users who had DarkVigil-compromised systems (assume credential theft)
    • Reset SSH keys, API tokens, and cloud service credentials
    • Implement multi-factor authentication (MFA) on critical systems

  3. C2 Takedown:

    • Report IOCs to CISA, FBI (CN threat division), and hosting providers for sinkholing
    • Coordinate with ISPs to filter traffic to known DarkVigil C2 infrastructure

Long-Term (Ongoing)

  1. Detection Engineering:

    • Develop Sigma rules for DarkVigil beaconing patterns in proxy logs
    • Implement memory forensics baseline for IME processes
    • Create compliance control: "All IME software must communicate via HTTPS with certificate pinning"

  2. Supply Chain Security:

    • Audit all IME and keyboard software for HTTPS enforcement in update channels
    • Require software vendors to publish Software Bill of Materials (SBOM)
    • Establish software authentication via signed catalogs (Windows WDAC AppLocker)

  3. Threat Hunting:

    • Query EDR for all keystroke logging API calls across organization (prioritize high-value users)
    • Correlate DNS hijack attempts with VPN/proxy access logs to identify network compromise vectors
    • Perform full-system memory forensics on flagged endpoints

Key Takeaways

  1. IME Weaponization as Emerging Tactic: Input Method Editors represent underestimated attack surface due to privileged execution context and user trust assumptions. Organizations must treat IME security as equivalent to kernel-level hardening.

  2. Protocol-Level Vulnerabilities Persist: Unencrypted HTTP update channels in software remain exploitable despite 20+ years of HTTPS standardization. Legacy software targeting non-Western markets often skips encryption to reduce latency/complexity.

  3. Attribution Confidence: SlippyNunchucks' operational security (targeting Chinese-speaking organizations, Sogou-specific expertise, FDMTP protocol reuse) indicates state-aligned threat actor with pre-existing surveillance infrastructure. TTPs align with known Chinese APT groups (APT31, APT41 variants).

  4. Detection Gaps: Most endpoint detection and response (EDR) platforms lack IME-specific behavioral baselines, allowing DarkVigil silent installation. Organizations relying on signature-based detection will miss this threat.

  5. DNS Hijacking as Strategic Attack: This campaign demonstrates why DNS security (DNSSEC, DNS-over-TLS, threat intelligence integration) must be elevated to critical infrastructure status alongside firewall rules.

Related Articles

References