Cybersecurity researchers at **ESET** have attributed a new DNS hijacking operation to **SlippyNunchucks**, a persistent threat actor believed to be aligned with the Chinese government. The campaign, which began as early as July 1, 2026, exploits insecure HTTP communications within Windows versions of **Sogou Input Method** to deploy a modular implant known as **DarkVigil** (also referred to as **FDMTP**). ### Targeting and Reach The campaign primarily targets organizations and Chinese-speaking individuals in Hong Kong, Thailand, Japan, Vietnam, Oman, and Sri Lanka. **ESET** researcher **Anh Ho** highlighted the actor's strategy: "By abusing these applications, the **SlippyNunchucks** threat actor has been able to reach Chinese-speaking users across Asia and Europe." Beyond **Sogou Input Method**, **SlippyNunchucks** has previously abused other popular Chinese applications such as **QuickFox**, **QingTalk**, **MiYunChat**, **SoftCam**, and **tawk.to**. ### DarkVigil: A Modular Threat Active since at least September 15, 2023, **SlippyNunchucks** is known for deploying a modular .NET framework that includes **DarkVigil** and a suite of over 20 plugins. While **DarkVigil** has been previously linked to **Mustang Panda**, **ESET** found no tactical overlaps in its telemetry, leading them to classify **SlippyNunchucks** as a distinct intrusion set. Earlier in August, **Fortinet's FortiGuard Incident Response Team** detailed **SlippyNunchucks**' supply chain compromise of the **QuickFox VPN** and network acceleration tool, also for **DarkVigil** delivery. ### The Sogou Input Method Exploit According to **ESET**, the adversary shifted to exploiting **Sogou Input Method**, a popular Chinese-language input method editor developed by **Tencent**, shortly after **QuickFox** released a clean version of its program. The attack specifically involves hijacking the app's branded vocabulary promotion mechanism. This mechanism, in a clean environment, sends an HTTP request to `config.pinyin.sogou[.]com/api/brandScd/getBrandScd.php` to fetch configuration data. In the observed attacks, the DNS resolution for this domain was tampered with, redirecting it to one of two staging servers: * `47.239.250[.]102` (sogou-cdn[.]com) * `47.237.122[.]175` (dev.soft-png-cdn.com)  This DNS hijacking routes HTTP requests to the malicious staging servers, which then respond with a crafted configuration. This configuration instructs **SGTool.exe**, a legitimate **Sogou Input Method** component, to download two additional payloads: 1. A legitimate **Adobe** executable (`biz_helper.exe`). 2. A rogue DLL (`libcef.dll`) containing **DarkVigil**, delivered via DLL sideloading. **DarkVigil** is notable for its use of **Duplex Message Transport Protocol (DMTP)** for command-and-control (C2), enabling the client to execute and orchestrate plugins for persistence and data collection. ### Remediation and Prior Incidents Following responsible disclosure, **Tencent** addressed the vulnerability (**CVE-2026-120422**) in version 16.10 of **Sogou Input Method**, released on October 29, 2026. The fix involved migrating the affected HTTP requests to HTTPS, thereby mitigating the DNS hijacking vector. **SlippyNunchucks** is suspected of operating in line with the interests of the Chinese government, with **ESET** classifying it as a nation-state surveillance effort. The group has shown particular interest in organizations operating Chinese-language online betting platforms in Sri Lanka, Hong Kong, and the Philippines, which aligns with China's strict gambling regulations. This is not the first instance of China-nexus threat actors weaponizing **Sogou Input Method**. In September 2026, **Gen Digital** reported a now-patched vulnerability (**CVE-2026-51990**) in the input method editor. This flaw was exploited by **UNC3569** to deliver a backdoor dubbed **GRAYRABBIT** via a crafted link. The exploit chain involved unvalidated command-line argument injection, unrestricted URL navigation in a CEF-based WebView, and an outdated, unsandboxed Chromium browser engine susceptible to **CVE-2021-38003**.