{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "promote-to-detection", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "SlippyNunchucks is an active China-aligned actor targeting organizations via AitM vectors. Detecting this DNS hijack is critical to stopping DarkVigil delivery before exfiltration." }, "name": "SlippyNunchucks Sogou Update Hijack", "type": "investigation", "labels": [ "hunt", "attack.t1574.001", "attack.t1036.005", "attack.t1105", "attack.t1557", "attack.t1659", "attack.t1190", "command and control", "execution", "exfiltration", "initial access", "persistence" ], "series": { "slug": "slippynunchucks-hijacks-sogou-input-method-s-brand-promotion-mechanism-to-distribute-malware", "index": 1, "title": "SlippyNunchucks hijacks Sogou Input Method\u2019s brand promotion mechanism to distribute malware", "total": 2 }, "related": [ { "hunt": "darkvigil-registry-persistence", "reason": "This hunt targets the delivery; the follow-on identifies how the implant stores plugins in the registry.", "relation": "follows" } ], "targets": { "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] } }, "analysis": "A rule for SGTool.exe writing DLLs is noisy due to legitimate updates. This hunt correlates specific network resolution anomalies (Alibaba IPs for Tencent domains) with rare file creation events that stack-count hashes across the fleet.", "coverage": [ { "stage": "initial-access-dns-hijack", "steps": [ "dns-hijack-detection" ], "status": "covered" }, { "stage": "execution-dll-side-loading", "steps": [ "rare-sgtool-file-writes" ], "status": "covered" }, { "stage": "persistence-registry-storage", "reason": "Belongs to another part of the 'SlippyNunchucks hijacks Sogou Input Method\u2019s brand promotion mechanism to distribute malware' series.", "status": "out_of_scope" }, { "stage": "command-and-control-dmtp", "reason": "Belongs to another part of the 'SlippyNunchucks hijacks Sogou Input Method\u2019s brand promotion mechanism to distribute malware' series.", "status": "out_of_scope" }, { "stage": "exfiltration-c2-channel", "reason": "Belongs to another part of the 'SlippyNunchucks hijacks Sogou Input Method\u2019s brand promotion mechanism to distribute malware' series.", "status": "out_of_scope" } ], "scenario": { "stages": [ { "name": "DNS Hijacking and Configuration Injection", "slug": "initial-access-dns-hijack", "tactic": "initial-access", "techniques": [ "T1557", "T1659", "T1190" ], "observables": [ "config.pinyin.sogou.com", "47.236.254.159", "47.237.122.175", "47.239.250.102", "CVE-2026-120422" ] }, { "name": "Payload Delivery and DLL Side-Loading", "slug": "execution-dll-side-loading", "tactic": "execution", "techniques": [ "T1574.001", "T1036.005", "T1105" ], "observables": [ "SGTool.exe", "libcef.dll", "Microsoft.VisualStudio.QualityTools.UnitTestFramework.dll", "sogou-cdn.com", "Adobe binary renamed as Sogou component" ] }, { "name": "Modular Plugin Storage", "slug": "persistence-registry-storage", "tactic": "persistence", "techniques": [ "T1112" ], "observables": [ "Compressed binaries stored in registry keys" ] }, { "name": "DarkVigil DMTP Communication", "slug": "command-and-control-dmtp", "tactic": "command-and-control", "techniques": [ "T1071.001", "T1573", "T1105" ], "observables": [ "blog.wangmen", "update.msspr", "img.fusfu", "47.86.15.162", "Duplex Message Transport Protocol (DMTP)", "dev.soft-pn" ] }, { "name": "Data Exfiltration via Vigil Panel", "slug": "exfiltration-c2-channel", "tactic": "exfiltration", "techniques": [ "T1041" ], "observables": [ "Vigil web administration panel", "DMTP exfiltration traffic" ] } ], "summary": "SlippyNunchucks hijacks Sogou Input Method\u2019s branded vocabulary promotion mechanism via DNS interception of insecure HTTP requests to deliver a malicious configuration. This configuration triggers the download of the DarkVigil implant, which is executed through DLL side-loading and maintains persistence by storing modular plugins within the Windows Registry. Command and control is handled via the custom Duplex Message Transport Protocol (DMTP) for tasking and data exfiltration." }, "severity": "high", "rationale": "Start with hosts running Sogou Pinyin, prioritizing South and East Asia regions. Use software inventory to narrow to versions before 16.10.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "An adversary has hijacked DNS resolution for Sogou Input Method update domains to deliver a malicious configuration, causing the legitimate SGTool.exe process to download and side-load the DarkVigil implant.", "parameters": { "scope_hosts": { "type": "list[host]", "default": [], "description": "Optional list of hostnames to focus the hunt; leave empty for fleet-wide." }, "attacker_ips": { "from": { "ref": "eset-research", "kind": "article", "observed": "2026-11-04" }, "type": "list[ip]", "default": [ "47.239.250.102", "47.237.122.175", "47.86.15.162", "47.236.254.159" ], "description": "Known attacker-controlled staging and hijacking IPs." }, "lookback_days": { "type": "number", "default": "14", "description": "Days of history to examine." }, "sogou_domains": { "from": { "ref": "eset-research", "kind": "article", "observed": "2026-11-04" }, "type": "list[domain]", "default": [ "config.pinyin.sogou.com", "sogou-cdn.com", "dev.soft-pn" ], "description": "Sogou update and configuration domains targeted for hijacking." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://www.welivesecurity.com/en/eset-research/slippynunchucks-hijacks-sogou-input-methods-brand-promotion-mechanism-to-distribute-malware/", "gates": [ "dry-run", "lint" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://www.welivesecurity.com/en/eset-research/slippynunchucks-hijacks-sogou-input-methods-brand-promotion-mechanism-to-distribute-malware/", "name": "ESET Research \u2014 SlippyNunchucks hijacks Sogou Input Method\u2019s brand promotion mechanism" } ], "blind_spots": [ { "id": "endpoint-telemetry-gap", "risk": "A host without an agent contributes no DNS or file activity rows, leaving it invisible to this hunt.", "stage": "initial-access-dns-hijack", "question": "Whether a host without an agent is resolving Sogou domains to rogue IPs.", "requires": "Endpoint agent on every host in scope" }, { "id": "dns-vector-blindness", "risk": "We see the results of the hijack but cannot identify the root cause of the network-level manipulation.", "stage": "initial-access-dns-hijack", "question": "How the DNS hijacking is being achieved (e.g., router compromise or ISP interception).", "requires": "Router or ISP-level DNS logs" } ] }, "name": "SlippyNunchucks Sogou Update Hijack", "description": "This hunt targets a sophisticated campaign where the SlippyNunchucks threat actor exploits insecure HTTP communications in Sogou Input Method (CVE-2026-120422). By hijacking DNS requests for Sogou's configuration domains, the attacker serves a malicious configuration that instructs the legitimate application to download payloads into directories used for DLL side-loading. The hunt identifies Sogou installations, detects anomalous DNS resolutions to infrastructure outside of Sogou's typical network (specifically targeting Alibaba-hosted staging areas), and corroborates these with rare file writes by the Sogou component manager SGTool.exe. An agent weighs the timing and prevalence of these indicators to identify compromised endpoints." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "series": { "slug": "slippynunchucks-hijacks-sogou-input-method-s-brand-promotion-mechanism-to-distribute-malware", "index": 1, "title": "SlippyNunchucks hijacks Sogou Input Method\u2019s brand promotion mechanism to distribute malware", "total": 2 }, "coverage": [ { "stage": "initial-access-dns-hijack", "steps": [ "dns-hijack-detection" ], "status": "covered" }, { "stage": "execution-dll-side-loading", "steps": [ "rare-sgtool-file-writes" ], "status": "covered" }, { "stage": "persistence-registry-storage", "reason": "Belongs to another part of the 'SlippyNunchucks hijacks Sogou Input Method\u2019s brand promotion mechanism to distribute malware' series.", "status": "out_of_scope" }, { "stage": "command-and-control-dmtp", "reason": "Belongs to another part of the 'SlippyNunchucks hijacks Sogou Input Method\u2019s brand promotion mechanism to distribute malware' series.", "status": "out_of_scope" }, { "stage": "exfiltration-c2-channel", "reason": "Belongs to another part of the 'SlippyNunchucks hijacks Sogou Input Method\u2019s brand promotion mechanism to distribute malware' series.", "status": "out_of_scope" } ], "rationale": "An adversary has hijacked DNS resolution for Sogou Input Method update domains to deliver a malicious configuration, causing the legitimate SGTool.exe process to download and side-load the DarkVigil implant.", "blind_spots": [ { "id": "endpoint-telemetry-gap", "risk": "A host without an agent contributes no DNS or file activity rows, leaving it invisible to this hunt.", "stage": "initial-access-dns-hijack", "question": "Whether a host without an agent is resolving Sogou domains to rogue IPs.", "requires": "Endpoint agent on every host in scope" }, { "id": "dns-vector-blindness", "risk": "We see the results of the hijack but cannot identify the root cause of the network-level manipulation.", "stage": "initial-access-dns-hijack", "question": "How the DNS hijacking is being achieved (e.g., router compromise or ISP interception).", "requires": "Router or ISP-level DNS logs" } ], "scoping_notes": "Start with hosts running Sogou Pinyin, prioritizing South and East Asia regions. Use software inventory to narrow to versions before 16.10.", "beyond_detection": "A rule for SGTool.exe writing DLLs is noisy due to legitimate updates. This hunt correlates specific network resolution anomalies (Alibaba IPs for Tencent domains) with rare file creation events that stack-count hashes across the fleet." } }, { "id": "sogou-inventory-scoping", "type": "query", "label": "Identify Sogou Input Method installations", "config": { "dsl": "sqlite", "role": "scoping", "source": "endpoint", "content": "SELECT device_hostname, package_name, package_version FROM hb_software_inventory WHERE (LOWER(package_name) LIKE '%sogou%' OR LOWER(package_name) LIKE '%pinyin%')", "surface": "hb_software_inventory", "description": "Identify hosts that have Sogou software installed to scope subsequent queries.", "expected_signal": "A list of hosts with Sogou software. Versions below 16.10 are vulnerable to the reported configuration hijacking." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "scoping", "label": "Identify Sogou Input Method installations", "reads": [ "device_hostname", "package_name", "package_version" ], "source": "hb_software_inventory", "target": "endpoint", "content": "SELECT device_hostname, package_name, package_version FROM hb_software_inventory WHERE (LOWER(package_name) LIKE '%sogou%' OR LOWER(package_name) LIKE '%pinyin%')", "silence": "not_evidence_of_absence", "expected": "A list of hosts with Sogou software. Versions below 16.10 are vulnerable to the reported configuration hijacking.", "verified": "dry-run", "verified_at": "2026-11-06" } }, { "id": "dns-hijack-detection", "type": "query", "label": "Detect DNS hijack of Sogou domains", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "endpoint", "content": "SELECT device_hostname, query_hostname, answers, time FROM hb_dns_activity WHERE (instr(',' || '{{sogou_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0 OR instr(',' || '{{attacker_ips}}' || ',', ',' || answers || ',') > 0) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_dns_activity", "description": "Identify if Sogou domains are resolving to attacker-controlled infrastructure.", "expected_signal": "DNS answers containing the reported attacker IPs for legitimate Sogou domains. Silence suggests normal resolution." }, "parents": [ { "id": "sogou-inventory-scoping" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "Detect DNS hijack of Sogou domains", "reads": [ "device_hostname", "query_hostname", "answers", "time" ], "source": "hb_dns_activity", "target": "endpoint", "content": "SELECT device_hostname, query_hostname, answers, time FROM hb_dns_activity WHERE (instr(',' || '{{sogou_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0 OR instr(',' || '{{attacker_ips}}' || ',', ',' || answers || ',') > 0) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "DNS answers containing the reported attacker IPs for legitimate Sogou domains. Silence suggests normal resolution.", "verified": "dry-run", "verified_at": "2026-11-06" } }, { "id": "rare-sgtool-file-writes", "type": "query", "label": "Identify rare binaries written by SGTool.exe", "config": { "dsl": "sqlite", "role": "baseline", "source": "endpoint", "content": "SELECT device_hostname, LOWER(file_path) AS path, file_name, file_hash_sha256, COUNT(DISTINCT device_hostname) AS host_count, MIN(time) AS first_seen FROM hb_file_activity WHERE LOWER(process_name) LIKE '%sgtool.exe' AND (LOWER(file_name) LIKE '%.dll' OR LOWER(file_name) LIKE '%.exe') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, file_path, file_name, file_hash_sha256 HAVING host_count <= 3 ORDER BY host_count ASC", "surface": "hb_file_activity", "description": "Find rare DLL or EXE files written by the Sogou component manager to distinguish malware delivery from standard updates.", "expected_signal": "A file written by SGTool.exe that is present on very few hosts. Legitimate software updates should be prevalent across the estate." }, "parents": [ { "id": "sogou-inventory-scoping" } ], "primitive_config": { "dsl": "sqlite", "role": "baseline", "label": "Identify rare binaries written by SGTool.exe", "reads": [ "device_hostname", "file_path", "file_name", "file_hash_sha256", "time" ], "source": "hb_file_activity", "target": "endpoint", "content": "SELECT device_hostname, LOWER(file_path) AS path, file_name, file_hash_sha256, COUNT(DISTINCT device_hostname) AS host_count, MIN(time) AS first_seen FROM hb_file_activity WHERE LOWER(process_name) LIKE '%sgtool.exe' AND (LOWER(file_name) LIKE '%.dll' OR LOWER(file_name) LIKE '%.exe') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, file_path, file_name, file_hash_sha256 HAVING host_count <= 3 ORDER BY host_count ASC", "silence": "not_evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "first_seen" }, "expected": "A file written by SGTool.exe that is present on very few hosts. Legitimate software updates should be prevalent across the estate.", "verified": "dry-run", "prevalence": { "by": "device_hostname", "key": [ "file_hash_sha256" ], "rare_below": 3 }, "verified_at": "2026-11-06" } }, { "id": "agent-triage", "type": "analytic", "label": "Weigh hijack and delivery evidence", "config": { "cite": "required", "tools": [ "endpoint" ], "context": [ "dns-hijack-detection", "rare-sgtool-file-writes" ], "objective": "Determine if the DNS resolution of Sogou domains to known attacker IPs (specifically Alibaba infrastructure) and the subsequent rare file writes by SGTool.exe indicate a successful SlippyNunchucks infection.", "description": "Analyze the combined evidence to determine if a host has been successfully compromised via DNS hijacking.", "max_iterations": 6, "expected_signal": "A verdict for each host associating rogue DNS answers with anomalous file creation events.", "success_criteria": "A per-host verdict of malicious | suspicious | benign, citing the DNS answers and the rare file paths." }, "parents": [ { "id": "dns-hijack-detection", "kind": "merge" }, { "id": "rare-sgtool-file-writes", "kind": "merge" } ] }, { "id": "route-on-verdict", "type": "checkpoint", "label": "Route on triage verdict", "config": { "fuzzy": true, "judge": "hunter", "question": "the agent-triage verdict is malicious for at least one host", "condition": "the agent-triage verdict is malicious for at least one host", "blind_spot": "endpoint-telemetry-gap", "confidence": "high", "description": "Initiate response for confirmed infections or manual review for suspicious patterns.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "agent-triage" } ] }, { "id": "isolate-host", "type": "action", "label": "Isolate compromised host", "config": { "target": "endpoint", "description": "Stop C2 traffic and prevent lateral movement.", "instructions": "Isolate the host immediately. Collect the rare DLL/EXE files identified by the hunt for forensic analysis, then remove the payloads and the SGTool.exe binary.", "action_approval": "required" }, "parents": [ { "id": "route-on-verdict", "branch": "on_supports" } ] }, { "id": "analyst-review", "type": "task", "label": "Analyst review and confirmation", "config": { "assignee": "analyst", "description": "Review indeterminate or suspicious findings to confirm if file writes represent legitimate updates or malicious hijacking.", "instructions": "Review the DNS answers and geolocate the IPs. Confirm if the written DLL is one of the reported names (libcef.dll, Microsoft.VisualStudio.QualityTools.UnitTestFramework.dll) or if its PE metadata matches the reported Adobe binary renaming." }, "parents": [ { "id": "route-on-verdict", "branch": "default" }, { "id": "route-on-verdict", "branch": "on_unavailable" }, { "id": "isolate-host" } ] }, { "id": "close-out", "type": "task", "label": "Close-out and documentation", "config": { "assignee": "analyst", "description": "Document findings and schedule follow-up actions for persistence checks.", "instructions": "Record the results. If infections were found, pivot to the follow-on hunt for registry-based plugin persistence. Ensure all Sogou installations are updated to version 16.10." }, "parents": [ { "id": "route-on-verdict", "branch": "on_refutes" }, { "id": "analyst-review" } ] } ] }