A China-aligned threat actor known as SlippyNunchucks has been linked to a DNS hijacking campaign targeting organizations and Chinese-speaking individuals across Asia. The operation abuses insecure HTTP communications in Windows versions of Sogou Input Method to deliver a surveillance implant called DarkVigil, also known as FDMTP.
According to cybersecurity company ESET, the campaign began on July 1, 2026, and has targeted victims in Hong Kong, Thailand, Japan, Vietnam, Oman, and Sri Lanka. The attackers have also abused popular applications, including QuickFox, QingTalk, MiYunChat, SoftCam, and tawk.to, to reach Chinese-speaking users across Asia and Europe.
The group, which has been active since at least September 2023, uses compromised software and legitimate application components to distribute malware. In the Sogou Input Method attack, the attackers hijack the application's vocabulary promotion feature to deliver a malicious configuration file and deploy DarkVigil via SGTool.exe, a legitimate component of the software that handles multiple tasks.
DarkVigil is part of a modular .NET framework that includes more than 20 plugins. The plugins allow attackers to expand the malware's capabilities, including collecting information and maintaining access to infected systems.
DarkVigil also uses the Duplex Message Transport Protocol (DMTP) for command-and-control (C&C) communication. DMTP is a binary protocol that works at the application layer and can operate over TCP, UDP, HTTP, WebSocket, and named pipes.
ESET says that SlippyNunchucks shifted to abusing Sogou Input Method just three days after QuickFox released a clean version of its software following a previous supply chain compromise.
Although DarkVigil has previously been associated with the China-linked Mustang Panda group, ESET said it didn’t observe tactical overlaps between the groups in its telemetry, so the researchers classify SlippyNunchucks as a separate threat actor.