[ctx]ctxseccontext security: attacks on the harness and context layer of AI agents, plus exploited-now news, hunting and playbooks.

← Threat Hunting · markdown

confirmed research (ESET Research / WeLiveSecurity, Nov 4; Tencent fix in Sogou Input Method 16.10)

Hunt: China-aligned SlippyNunchucks hijacked DNS for Sogou Input Method's plain-HTTP config requests to plant the DarkVigil backdoor (CVE-2026-120422)

  • Update: Sogou Input Method for Windows to 16.10 or later.
  • Endpoint: look for libcef.dll or an Adobe-signed binary under \SogouInput\Components\ or \Components\biz_center\<version>\, and a SogouComMgr.exe whose signer is Adobe rather than Sogou/Tencent. DarkVigil stores plugins in HKCU\Software\Microsoft\IME\.
  • Network: config.pinyin.sogou[.]com resolving to anything other than Sogou's infrastructure, especially 47.239.250[.]102, 47.237.122[.]175 or 47.236.254[.]159; domains sogou-cdn[.]com, dev.soft-png-cdn[.]com, blog.wangmengfun[.]top, update.mssproxy[.]net, img.fusfun[.]top; 47.86.15[.]162. DarkVigil's C2 uses the DMTP protocol (messages start with the bytes dm).
  • Hashes (SHA-1): 8A60A8E90E1F5F08F28FE5A6DD57BD686C20DC23 (libcef.dll), 3E16BA611782AF6E45576D390488D28FD676BADE. Full list in ESET's GitHub.

Sources: ESET WeLiveSecurity: SlippyNunchucks hijacks Sogou Input Method's brand promotion mechanism to distribute malware (Nov 4)