China-Aligned SlippyNunchucks Hijacks Sogou Input Method Updates to Deploy DarkVigil Malware
ESET researcher Anh Ho disclosed a campaign by a China-aligned group tracked as SlippyNunchucks, which abused the brand-promotion mechanism of Sogou Input Method (owned by Tencent) to deliver the DarkVigil (aka FDMTP) implant. The group used DNS hijacking to redirect an unencrypted HTTP request made by a Sogou component to attacker-controlled servers, which returned a malicious configuration causing the app to download and execute DarkVigil under Sogou's own trusted process, achieving persistence without a separate mechanism. ESET traces SlippyNunchucks activity back to at least September 15, 2023, and assesses with high confidence that the group is tied to Chinese state-aligned surveillance interests. Victims spanning six countries (Hong Kong, Thailand, Japan, Vietnam, Sri Lanka, and Oman) included a multinational gambling organization, a Dubai internet café, and a Denmark-based university student.
Detalhes técnicos
The Sogou component fetched its brand-promotion configuration over plaintext HTTP; DNS hijacking rerouted this request to attacker infrastructure. ESET does not know where the DNS manipulation occurred, citing possible router misconfiguration, router implants, or ISP-level interception. DarkVigil/FDMTP is a modular .NET toolset with more than 20 plugins. While Darktrace previously linked FDMTP to Mustang Panda with moderate confidence, ESET's telemetry showed no overlap and tracks SlippyNunchucks as a distinct cluster. Prior to this campaign, the group's only known distribution method was a supply-chain compromise of QuickFox. ESET links the gambling-sector targeting to China's gambling restrictions and to China-aligned groups' apparent support for law enforcement actions against Chinese nationals tied to regional fraud.
Remediação
ESET reported the issue to Tencent on September 11, 2026; Tencent acknowledged it September 21. Sogou Input Method version 16.10 (late October) moved the affected requests to HTTPS and enabled certificate pinning, closing the abused unencrypted channel. ESET notes the downloader component still does not validate downloaded file types or restrict save locations, leaving residual risk.
Linha do tempo
-
China-Aligned SlippyNunchucks Hijacks Sogou Input Method Updates to Deploy DarkVigil Malware
ler a análise desta fonte ocultar
ESET researcher Anh Ho disclosed a campaign by a China-aligned group tracked as SlippyNunchucks, which abused the brand-promotion mechanism of Sogou Input Method (owned by Tencent) to deliver the DarkVigil (aka FDMTP) implant. The group used DNS hijacking to redirect an unencrypted HTTP request made by a Sogou component to attacker-controlled servers, which returned a malicious configuration causing the app to download and execute DarkVigil under Sogou's own trusted process, achieving persistence without a separate mechanism. ESET traces SlippyNunchucks activity back to at least September 15, 2023, and assesses with high confidence that the group is tied to Chinese state-aligned surveillance interests. Victims spanning six countries (Hong Kong, Thailand, Japan, Vietnam, Sri Lanka, and Oman) included a multinational gambling organization, a Dubai internet café, and a Denmark-based university student.
Technical Details
The Sogou component fetched its brand-promotion configuration over plaintext HTTP; DNS hijacking rerouted this request to attacker infrastructure. ESET does not know where the DNS manipulation occurred, citing possible router misconfiguration, router implants, or ISP-level interception. DarkVigil/FDMTP is a modular .NET toolset with more than 20 plugins. While Darktrace previously linked FDMTP to Mustang Panda with moderate confidence, ESET's telemetry showed no overlap and tracks SlippyNunchucks as a distinct cluster. Prior to this campaign, the group's only known distribution method was a supply-chain compromise of QuickFox. ESET links the gambling-sector targeting to China's gambling restrictions and to China-aligned groups' apparent support for law enforcement actions against Chinese nationals tied to regional fraud.
Remediation
ESET reported the issue to Tencent on September 11, 2026; Tencent acknowledged it September 21. Sogou Input Method version 16.10 (late October) moved the affected requests to HTTPS and enabled certificate pinning, closing the abused unencrypted channel. ESET notes the downloader component still does not validate downloaded file types or restrict save locations, leaving residual risk.