Hackers Exploit Sogou Input Method Vulnerability to Install DarkVigil Spyware on Windows Computers
ID: c5870fff-049a-5fc5-8298-4f4837d6f64b
STIX ID: report--c5870fff-049a-5fc5-8298-4f4837d6f64b
Feed Name: Cyber Press
ESET attributes a China-aligned group called SlippyNunchucks with hijacking Sogou Input Method update-style requests (via DNS manipulation) to deploy the DarkVigil (FDMTP) spyware across Hong Kong, Thailand, Japan, Vietnam, Oman, and Sri Lanka; attackers pointed Sogou config requests to malicious servers to deliver a signed Adobe helper (side-loaded libcef.dll) and the DarkVigil implant, ESET disclosed CVE-2026-120422 and Tencent released a fix in Sogou 16.10. Indicators provided include sogou-cdn.com, dev.soft-png-cdn.com, IPs 47.239.250.102 and 47.237.122.175, and libcef.dll SHA-1 8A60A8E90E1F5F08F28FE5A6DD57BD686C20DC23.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.