- Since 2025, ESET has been tracking the DarkVigil malware ecosystem and its operator; SlippyNunchucks is the name that ESET has assigned to the associated APT group behind the attack.
- ESET Research has discovered a DNS hijacking operation by this group. The operation abuses Sogou Input Method’s app use of insecure HTTP communications.
- According to ESET telemetry, this operation targeted organizations and Chinese-speaking individuals in Hong Kong, Thailand, Japan, Vietnam, Oman, and Sri Lanka.
- Tencent, the app’s developer, responded promptly and released a patch to address the CVE-2026-120422 vulnerability.
BRATISLAVA, Slovakia and MONTREAL, Nov. 04, 2026 (GLOBE NEWSWIRE) -- ESET Research has discovered and analyzed a DNS hijacking operation abusing insecure HTTP communications in Windows versions of Sogou Input Method, a Chinese-language input method editor developed by Tencent. The China-aligned SlippyNunchucks APT group is behind this latest surveillance campaign. As the operator of the DarkVigil malware ecosystem, it has targeted organizations and Chinese-speaking individuals in Hong Kong, Thailand, Japan, Vietnam, Oman, and Sri Lanka. SlippyNunchucks has also been able to reach users across Asia and Europe.
“In July 2026, we observed DarkVigil implants being launched by the Sogou Input Method component SGTool.exe. Further investigation revealed that a request, which belongs to the application’s branded vocabulary promotion mechanism, was hijacked to serve a malicious configuration. This configuration instructs the binary to place the payloads in selected locations that enable their execution through Sogou Input Method’s existing workflows,” said ESET researcher Anh Ho, who discovered the operation and vulnerability. “SGTool.exe is a legitimate Sogou Input Method component that functions as a multipurpose task dispatcher,” he added.
Sogou Input Method (also known as Sogou Pinyin) is one of the most widely used Chinese input method editors for typing Chinese characters on computers and mobile devices; it has previously appeared in threat intelligence investigations.
Shortly after uncovering the operation, ESET contacted the Tencent Security Response Center to report the abuse and share its findings. Tencent responded promptly and released a patch to address the CVE-2026-120422 vulnerability. The app’s 16.10 version addresses the issue by migrating the affected HTTP requests to HTTPS. This change mitigates the risk of malicious configuration delivery through DNS hijacking by enforcing TLS certificate validation.
ESET Research has been tracking the DarkVigil toolset (or FDMTP) since early 2025. The name DarkVigil is derived from the malware framework’s internal name, Vigil, which appears in library references. Additionally, ESET discovered the web administration panel used to manage data exfiltrated by the implant. The panel displays a logo bearing the Vigil name.
SlippyNunchucks has been active since at least 2023, with cyberespionage activities centering on the deployment and operation of the DarkVigil toolset (also known as FDMTP). The group mainly targets organizations and Chinese-speaking individuals across South and East Asia. Occasionally, the group has targeted victims in Europe, including individuals in Germany, Russia, the UK, and Austria. Notable victims include a multinational gambling organization that operates out of Sri Lanka, the Philippines, and Hong Kong; an internet café in Dubai; and a university student in Denmark.
In ESET telemetry, DarkVigil-related activity forms a distinct cluster indicative of an APT group whose operations center on the deployment and use of this toolset. ESET tracks this threat actor as SlippyNunchucks. Contrary to public reporting that attributes DarkVigil to Mustang Panda (also known as Twill Typhoon), ESET telemetry has not revealed any overlaps between DarkVigil-related activity and Mustang Panda activity.
For more details about SlippyNunchucks and its latest campaign, check out the ESET Research blogpost “SlippyNunchucks hijacks Sogou Input Method’s brand promotion mechanism to distribute malware,” on WeLiveSecurity.com. Make sure to follow ESET Research on Twitter (today known as X), BlueSky, and Mastodon for the latest news from ESET Research.
About ESET®
ESET protects organizations, critical infrastructure, and individuals, helping them build digital resilience and confidence in an increasingly AI-driven world. With more than 35 years of cybersecurity expertise, over 25 years of AI innovation, and 11 global R&D centers, ESET develops proprietary technologies designed to protect against evolving cyber threats and secure the broader AI ecosystem. Grounded in scientific rigor and taking a preemptive approach to security, ESET delivers effortless protection that remains under expert human oversight. Headquartered in the European Union and privately owned, ESET protects millions of users and more than 500,000 organizations across 178 countries. Committed to responsible AI and customer trust, ESET protects the progress that technology enables. For more information, visit www.eset.com or follow ESET’s social media, podcasts, and blogs.
