Ethical Hacking News
SlippyNunchucks, a China-aligned threat actor, has been linked to a DNS hijacking operation abusing Sogou Input Method DNS requests to deploy DarkVigil, a notorious implant used for surveillance and data collection. The campaign, observed starting July 1, 2026, has targeted organizations and Chinese-speaking individuals across Asia and Europe, sparking concerns about China's nation-state surveillance efforts.
SlippyNunchucks, a China-aligned threat actor, has been attributed to a DNS hijacking operation targeting organizations and Chinese-speaking individuals in multiple countries. The campaign abuses insecure HTTP communications in Windows versions of Sogou Input Method to deploy a surveillance campaign. The malware, DarkVigil, is deployed through popular Chinese applications and uses Duplex Message Transport Protocol (DMTP) for command-and-control (C2). The targeting of organizations is notable given China's restrictions on gambling, suggesting a nation-state surveillance effort. This is not the first time China-nexus threat actors have weaponized the Sogou Input Method as an entry point for malware distribution.
SlippyNunchucks, a China-aligned threat actor, has been attributed to a Domain Name System (DNS) hijacking operation abusing insecure HTTP communications in Windows versions of Sogou Input Method. The campaign, observed starting July 1, 2026, is assessed to have targeted organizations and Chinese-speaking individuals in Hong Kong, Thailand, Japan, Vietnam, Oman, and Sri Lanka, according to ESET.
The campaign, which is believed to be a surveillance campaign designed to deploy an implant called DarkVigil (aka FDMTP), has been linked to a notorious threat actor known for targeting organizations and Chinese-speaking individuals across South and East Asia. Active since at least September 15, 2023, SlippyNunchucks is known for its modular .NET framework that includes DarkVigil and a set of over 20 plugins.
According to ESET researcher Anh Ho, "DarkVigil implants are typically deployed through popular Chinese applications." By abusing these applications, the SlippyNunchucks threat actor has been able to reach Chinese-speaking users across Asia and Europe. Some of the applications abused by the adversary include Sogou Input Method, QuickFox, QingTalk, MiYunChat, SoftCam, and tawk.to.
The attack involves hijacking the app's branded vocabulary promotion mechanism to serve a malicious configuration, which ultimately paves the way for the deployment of the malware via SGTool.exe, a legitimate Sogou Input Method component that functions as a multi-purpose task dispatcher. In a clean environment, the executable sends an HTTP request to the "config.pinyin.sogou[.]com/api/brandScd/getBrandScd.php" endpoint to fetch a configuration. However, in the attack discovered by ESET, the DNS resolution of the domain is tampered with to resolve it to one of the two staging servers - 47.239.250[.]102 (sogou-cdn[.]com) and 47.237.122[.]175 (dev.soft-png-cdn.com).
The consequence of this DNS hijacking was that HTTP requests to the "getBrandScd.php" endpoint were routed to one of the staging servers, which then responded with a malicious configuration. The configuration, for its part, instructs the binary to download two additional payloads from "sogou-cdn[.]com" and launch the malware via DLL sideloading - A legitimate Adobe executable ("biz_helper.exe") and a rogue DLL ("libcef.dll") containing DarkVigil.
DarkVigil is notable for its use of Duplex Message Transport Protocol (DMTP) for command-and-control (C2), allowing the client to execute and orchestrate plugins received from an attacker-controlled server to facilitate persistence or data collection. The use of DMTP enables the threat actor to maintain a level of stealth and anonymity, making it challenging for security professionals to detect and respond to the threat.
The targeting of this organization is notable given China's restrictions on gambling, including criminal penalties for operating gambling businesses and organizing Chinese citizens to gamble abroad. ESET described SlippyNunchucks as a nation-state surveillance effort, suggesting that the threat actor is operating in the interests of the Chinese government.
This is not the first time China-nexus threat actors have weaponized the Sogou Input Method as an entry point for malware distribution. In September 2026, Gen Digital said a now-patched vulnerability in the input method editor (CVE-2026-51990) was exploited by UNC3569 to deliver a backdoor dubbed GRAYRABBIT by means of a crafted link.
The vulnerability chains three separate weaknesses into a single, one-click exploit: unvalidated command-line argument injection in the sgbiz: custom protocol handler, unrestricted URL navigation in a CEF-based WebView, and a severely outdated, unsandboxed Chromium browser engine [susceptible to CVE-2021-38003], Gen Digital said.
Related Information:
https://www.ethicalhackingnews.com/articles/Unveiling-the-Shadowy-World-of-SlippyNunchucks-A-China-Aligned-Threat-Actor-Exploiting-Sogou-Input-Method-DNS-Requests-ehn.shtml
https://thehackernews.com/2026/11/china-aligned-hackers-hijack-sogou.html
Published: Wed Nov 4 07:27:21 2026 by llama3.2 3B Q4_K_M
