China-Linked SlippyNunchucks Uses Sogou Input Method DNS Hijacking to Deploy DarkVigil Malware

Cybersecurity researchers have uncovered a surveillance campaign attributed to SlippyNunchucks, a China-aligned threat actor that abused insecure HTTP communications in Windows versions of Sogou Input Method to hijack DNS requests and distribute a sophisticated malware implant known as DarkVigil, also called FDMTP.

The campaign began on July 1, 2026, and targeted organizations and Chinese-speaking individuals across Hong Kong, Thailand, Japan, Vietnam, Oman and Sri Lanka, according to cybersecurity company ESET.

Researchers said the attackers exploited popular Chinese applications to reach potential victims across Asia and Europe. The applications abused in the campaign included Sogou Input Method, QuickFox, QingTalk, MiYunChat, SoftCam and tawk.to.

SlippyNunchucks has been active since at least September 15, 2023, and is known for targeting organizations and Chinese-speaking individuals across South and East Asia. Its operations have involved a modular .NET framework containing DarkVigil and more than 20 plugins.

Although DarkVigil has previously been associated with Mustang Panda, ESET reported no tactical overlap between that group and the activity observed in its telemetry. Researchers therefore classified SlippyNunchucks as a separate intrusion set.

Attackers Abuse Sogou Input Method's Promotion Mechanism

Following a supply-chain compromise involving the QuickFox VPN and network acceleration application, the threat actor shifted to abusing Sogou Input Method as a malware delivery mechanism.

ESET found that this transition occurred just three days after QuickFox released a clean version of its software.

The attackers exploited Sogou's branded vocabulary promotion mechanism to deliver a malicious configuration file. This configuration ultimately caused a legitimate Sogou component, SGTool.exe, to download and execute additional malware.

Under normal conditions, SGTool.exe sends an HTTP request to the following endpoint to retrieve configuration information:

config.pinyin.sogou[.]com/api/brandScd/getBrandScd.php

However, in the malicious campaign, attackers manipulated DNS resolution so that requests intended for the legitimate domain were redirected to attacker-controlled staging infrastructure.

Researchers identified two staging servers:

  • 47.239.250[.]102 associated with sogou-cdn[.]com
  • 47.237.122[.]175 associated with dev.soft-png-cdn.com

The redirected HTTP requests returned a malicious configuration instructing SGTool.exe to download two additional files:

  1. A legitimate Adobe executable named biz_helper.exe.
  2. A malicious DLL named libcef.dll containing the DarkVigil implant.

The malware was then executed through DLL sideloading, allowing attackers to abuse a legitimate executable to load their malicious library.

DarkVigil Malware and Its Capabilities

DarkVigil is a modular .NET-based implant that uses the Duplex Message Transport Protocol (DMTP) for command-and-control communications.

The malware allows attackers to receive and execute plugins from an attacker-controlled server. These plugins support different operations, including persistence and data collection.

The modular architecture gives operators flexibility to extend the malware's capabilities depending on their operational requirements.

The campaign demonstrates how attackers can exploit trusted applications and their update or configuration mechanisms to distribute malware without relying exclusively on conventional malicious attachments.

Tencent Releases a Security Fix

Following responsible disclosure, Tencent addressed the vulnerability tracked as CVE-2026-120422 in Sogou Input Method version 16.10, released on October 29, 2026.

The update moved the affected HTTP communications to HTTPS, addressing the insecure communication mechanism exploited in the DNS hijacking operation.

Users should update Sogou Input Method to the fixed version and ensure that applications obtained through third-party distribution channels are legitimate.

Surveillance Targets Across Asia

ESET assesses SlippyNunchucks as a nation-state surveillance operation aligned with Chinese government interests.

Researchers identified significant surveillance activity involving an organization operating Chinese-language online betting platforms in Sri Lanka, Hong Kong and the Philippines.

ESET highlighted this targeting because of China's restrictions on gambling, including criminal penalties associated with operating gambling businesses and organizing Chinese citizens to gamble abroad.

The findings suggest that the threat actor's targeting may extend beyond traditional government and enterprise organizations to individuals and businesses connected to specific regional interests.

Previous Sogou Input Method Exploitation

This is not the first time China-aligned threat actors have exploited Sogou Input Method to distribute malware.

In September 2026, Gen Digital disclosed a separate vulnerability, CVE-2026-51990, that was reportedly exploited by the China-linked threat actor UNC3569 to deliver a backdoor called GRAYRABBIT through a specially crafted link.

The vulnerability chained three weaknesses into a one-click exploitation path:

  • Unvalidated command-line argument injection in the sgbiz: custom protocol handler.
  • Unrestricted URL navigation in a Chromium Embedded Framework (CEF)-based WebView.
  • An outdated, unsandboxed Chromium browser engine vulnerable to CVE-2021-38003.

The separate incidents demonstrate how trusted Chinese-language applications can become attractive targets for attackers seeking access to large populations of users.

Security Recommendations

Organizations and individuals using affected applications should take the following precautions:

  • Update Sogou Input Method to version 16.10 or later.
  • Verify application downloads and updates through official distribution channels.
  • Monitor unexpected DNS resolutions and connections to suspicious infrastructure.
  • Investigate unusual HTTP requests involving Sogou configuration endpoints.
  • Monitor for suspicious DLL sideloading involving legitimate executables.
  • Review endpoints for unexpected execution of SGTool.exe, biz_helper.exe and unfamiliar DLL files.
  • Use endpoint detection and network monitoring to identify suspicious command-and-control activity.

The SlippyNunchucks campaign highlights the risks of insecure application communications and trusted software distribution mechanisms. By manipulating DNS responses and abusing legitimate application components, attackers can turn widely used software into an effective delivery channel for targeted espionage malware.