ESET Research Exposes Sogou Input Method DNS Hijacking: What IT Teams Should Do

Chinese-language input software is easy to overlook in an endpoint security review. It is often treated as a productivity utility rather than a business application with network connections, update mechanisms and deep integration with desktop input workflows. New research from ESET shows why that assumption deserves a second look.

On 4 November 2026, ESET Research disclosed a DNS-hijacking operation in which the SlippyNunchucks threat group abused insecure HTTP communications in Windows versions of Sogou Input Method to deliver the DarkVigil malware toolset. ESET telemetry identified targeting of organisations and Chinese-speaking individuals in Hong Kong as well as several other Asian markets. For Hong Kong IT teams, the lesson is not to ban Chinese input methods indiscriminately. It is to inventory them, keep them patched and monitor the software behaviours that can turn a trusted utility into an attack path.

What happened in the Sogou Input Method campaign?

ESET said it observed DarkVigil implants being launched by a legitimate Sogou component, SGTool.exe, from 1 July 2026. Further investigation found that a request used by the application’s branded vocabulary promotion feature was being redirected through DNS manipulation. Because the affected request used unencrypted HTTP, an attacker able to influence name resolution could direct the request to an attacker-controlled server and return a malicious configuration.

The configuration instructed Sogou components to download files and place them in locations that could be reached through the application’s existing component-management workflow. ESET described a signed Adobe helper executable being renamed and used to load a malicious DLL. This is a form of DLL side-loading: a legitimate-looking executable is made to load an attacker-supplied library. By abusing normal application workflows, the operation could execute DarkVigil without relying on a conventional user-launched installer.

ESET tracks the operator as SlippyNunchucks and the malware ecosystem as DarkVigil, also known as FDMTP. The research describes a modular toolset capable of collecting information and communicating with its operators. The investigation also notes that the exact point at which DNS manipulation occurred remains unknown. Possible explanations include compromised routers or DNS settings, but ESET did not establish a single confirmed interception point.

A patch is available — but organisations still need to verify it

Following ESET’s disclosure, Tencent released Sogou Input Method version 16.10 on 30 October 2026. ESET reports that the update moves the affected requests from HTTP to HTTPS and adds certificate pinning, helping prevent a malicious configuration from being delivered through the same DNS-hijacking method. The vulnerability is identified as CVE-2026-120422.

That is an important mitigation, but a vendor’s release announcement is not the same as proof that every company endpoint has been updated. IT teams should confirm which devices have Sogou installed, identify the actual version in use and verify that updates came from an authorised distribution channel. If a device cannot be updated immediately, record the exception, identify its owner and apply proportionate temporary controls.

Do not assume that every Sogou installation is compromised, or that removing the application is automatically the right response. First establish whether it is present, whether the affected Windows version is in use and whether the installed release is older than the patched version. Escalate devices showing suspicious activity for investigation rather than relying on a version check alone.

Why this matters to Hong Kong businesses

Chinese input methods are common in multilingual workplaces, especially where staff communicate with customers, suppliers and colleagues in Traditional or Simplified Chinese. They may be installed by individual users, bundled with device images or added by local support teams. As a result, the software can sit outside the formal application inventory even when it is used every day.

Hong Kong organisations also operate across regional supply chains and distributed networks. A laptop may move between office, home and public networks, while remote staff connect through home routers and third-party internet services. If an application relies on insecure network requests, endpoint protection alone may not address every part of the exposure. Software integrity, DNS controls, endpoint telemetry and network monitoring need to work together.

The campaign is a reminder that the attack surface includes more than browsers, office suites and remote-access tools. Language utilities, collaboration add-ons, document converters and update agents can all make outbound requests and load executable components. Their business value does not remove the need for security ownership.

Seven practical actions for IT and security teams

1. Find every installation

Use endpoint management, software inventory and EDR data to identify Windows devices running Sogou Input Method. Include laptops used by remote employees, shared workstations and devices managed by local offices. Record the installed version, installation source, device owner and business reason for use. If the application is not approved, do not simply ignore it: determine whether it is needed and who is responsible for supporting it.

2. Confirm the patched version

Prioritise devices running versions earlier than 16.10 for update verification. Obtain the update through the vendor’s official channel or a trusted software distribution process. Validate the resulting version after deployment rather than treating a successful installation job as sufficient evidence. Where software distribution is centralised, retain deployment records and identify endpoints that missed the update.

3. Review application behaviour, not just file names

Security monitoring should be able to investigate unusual child processes, unexpected executable or DLL changes in application directories, and a legitimate utility launching components in an abnormal way. A signed file is not automatically safe in every context: attackers may abuse a genuine binary to load a malicious library. Use EDR telemetry, application control and file-integrity checks to assess the relationship between the parent process, loaded modules and destination paths.

4. Strengthen DNS and network visibility

Review how corporate devices obtain DNS settings and how changes to resolvers are controlled. Monitor for unexpected DNS configuration changes, unusual answers for business-critical domains and connections to destinations that do not fit the application’s normal behaviour. Use managed DNS, secure web gateways or network detection controls where appropriate. Because ESET did not determine the precise point of DNS manipulation in this campaign, avoid assuming that one network device or one control will address every possible path.

5. Reduce local privilege and limit execution paths

Most employees do not need local administrator rights for routine typing and office work. Apply least privilege, restrict software installation to approved processes and use application-control policies where they are operationally practical. These controls can reduce the opportunity for an attacker to write files into sensitive application directories or execute unexpected components.

6. Check for signs of exposure

If an endpoint has an outdated installation or suspicious telemetry, preserve relevant EDR and DNS records before making changes that could remove evidence. Review process execution, file creation, module loading and outbound connections around the time of the suspected activity. If compromise is plausible, isolate the device according to the incident-response plan, investigate credential exposure and assess whether other devices share the same software or network conditions.

7. Make application ownership explicit

Assign an owner for commonly used language and productivity utilities. Define who approves installation, monitors vendor advisories, tests updates and handles exceptions. Include these applications in vulnerability-management reviews and endpoint baselines. A small inventory entry can prevent a widely deployed utility from remaining invisible to security operations.

Questions to ask when reviewing endpoint security

Hong Kong buyers evaluating endpoint protection or managed detection and response should test the controls against realistic application-abuse scenarios. Can the platform show which devices run a specific utility and which version is installed? Can analysts investigate a legitimate process loading an unexpected DLL? Does it correlate process activity with DNS and network events? Can administrators isolate a device and collect evidence without losing the context needed for an investigation?

Also ask how the service handles software that is legitimate but not formally approved. A useful security programme should help discover and assess such applications, not simply classify everything unknown as malicious. Confirm how alerts are prioritised, who investigates them outside business hours and what evidence is included in incident reports.

A 30-day response plan

Days 1–7: Identify Sogou installations and owners, determine the Windows versions and compare installed releases with the patched 16.10 version. Flag devices that cannot be reached or updated.

Days 8–14: Deploy the vendor update through an approved channel, validate versions and review EDR and DNS telemetry for devices with older installations or unusual behaviour.

Days 15–21: Review local administrator rights, application-control policies, DNS configuration management and software inventory coverage. Document any exceptions and temporary controls.

Days 22–30: Run a short tabletop exercise involving a trusted utility that receives a malicious configuration. Test how the service desk, endpoint team, network team and incident responders share evidence and make isolation decisions. Update the endpoint baseline and software approval process based on the findings.

Turn a research finding into stronger endpoint governance

ESET’s investigation is a specific case involving Sogou Input Method, insecure HTTP requests and DNS manipulation; it should not be read as evidence that every Chinese input method is unsafe. Its wider significance is that a familiar productivity application can become a delivery route when network communications and component-loading workflows are not adequately protected.

For Hong Kong organisations, the practical response is clear: know which utilities are installed, verify the vendor’s security update, monitor how applications launch and load components, and maintain visibility across endpoint and DNS activity. These steps improve resilience without disrupting legitimate Chinese-language workflows. They also establish a repeatable way to manage the next overlooked application that becomes part of an attack chain.