At ESET, we have been tracking the DarkVigil toolset (also known as FDMTP) and its operator, the SlippyNunchucks threat actor, since 2025. Across the campaigns we have analyzed, one behavior has remained consistent: DarkVigil implants are typically deployed through popular Chinese applications. By abusing these applications, the SlippyNunchucks threat actor has been able to reach Chinese-speaking users across Asia and Europe. Until now, how these applications are being abused to achieve execution has remained largely unclear.
So far, only one attack vector has been publicly identified: a compromise of the QuickFox supply chain. This incident was analyzed in a Fortinet article and independently in an ESET Threat Intelligence report. Shortly after the supply-chain compromise ended, SlippyNunchucks shifted to abusing Sogou Input Method to deploy DarkVigil.
On July 1st, 2026, three days after QuickFox released the clean version, we continued to observe DarkVigil implants being launched, this time by the Sogou Input Method component SGTool.exe. Further investigation revealed that a request, which belongs to the application’s branded vocabulary promotion mechanism, was hijacked to serve a malicious configuration. This configuration instructs the binary to place payloads in selected locations that enable their execution through Sogou Input Method’s existing workflows.
After uncovering the operation, we contacted the Tencent Security Response Center to report the abuse and share our findings. Tencent responded promptly and released an update to address the issue. We greatly appreciate the team’s swift response and cooperation.
Vulnerability disclosure timeline:
- 2026‑09‑11: ESET Research reported the security weakness to the Tencent Security team.
- 2026‑09‑21: Tencent Security responded and acknowledged the issue.
- 2026‑10‑30: Tencent addressed the issue in version 16.10.
- 2026‑11‑02: ESET CNA issued a CVE ID for the vulnerability (CVE-2026-120422).
- 2026‑11‑04: ESET Research published the blogpost.
Key points of this blogpost:
- Since 2025, we have been tracking the DarkVigil malware ecosystem and its operator, which we refer to as SlippyNunchucks.
- We uncovered a SlippyNunchucks DNS hijacking operation, abusing Sogou Input Method’s use of insecure HTTP communications.
- In our telemetry, we observed that this operation targeted organizations and Chinese-speaking individuals in Hong Kong, Thailand, Japan, Vietnam, Oman, and Sri Lanka.
- The point at which DNS manipulation occurs remains unknown.
- We analyzed DarkVigil’s C&C architecture, which uses the Duplex Message Transport Protocol.
SlippyNunchucks profile
SlippyNunchucks is a China-aligned threat actor that has been active since at least September 15th, 2023. Its cyberespionage activities center on the deployment and operation of the DarkVigil toolset (also known as FDMTP). DarkVigil is a modular .NET toolset that includes the DarkVigil implant and more than 20 known plugins. The toolset is built on the Vigil malware framework, which is built on the TouchSocket networking framework. TouchSocket implements DMTP, a network protocol DarkVigil uses for C&C communications. Data exfiltrated by the malware is managed through a web administration panel that is also branded as Vigil.
SlippyNunchucks mainly targets organizations and Chinese-speaking individuals across South and East Asia. Occasionally, the group targeted victims in Europe, including individuals in Germany, Russia, the UK, and Austria. Notable victims include a multinational gambling organization that operates out of Sri Lanka, the Philippines, and Hong Kong; an Internet café in Dubai; and a university student in Denmark.
Context
ESET Research has been tracking the DarkVigil toolset (or FDMTP) since early 2025. The name DarkVigil is derived from the malware framework’s internal name, Vigil, which appears in library references such as using Vigil.Frame and using Vigil.Core, and in PDB paths such as:
C:\Users\PT\Desktop\VigilPro\Client\Dotnet\Client.Core\[redacted]C:\Users\PT\Desktop\VigilⅢ\Client\Dotnet\Plugins\[redacted]
Additionally, we discovered the web administration panel used to manage data exfiltrated by the implant. The panel displays a logo bearing the Vigil name, as demonstrated in Figure 1.
Figure 1. Vigil logo displayed in the web administrator panel
In our telemetry, DarkVigil-related activity forms a distinct cluster indicative of a China-aligned APT group whose operations center on the deployment and use of this toolset. We track this threat actor as SlippyNunchucks.
Contrary to public reporting that attributes DarkVigil to Mustang Panda (also known as Twill Typhoon), our telemetry has not revealed any overlaps between DarkVigil-related activity and Mustang Panda activity. We assess that SlippyNunchucks is a distinct China-aligned APT group that we track independently and for which we currently have no known associations with Mustang Panda.
Since 2025, SlippyNunchucks has abused several Chinese applications, including Sogou Input Method, QuickFox, QingTalk, MiYunChat, SoftCam, and tawk.to, to deploy DarkVigil implants. This approach has enabled SlippyNunchucks to reach Chinese-speaking users abroad, particularly across Asia and Europe. Based on consistent patterns in the victimology and tactics, we assess with high confidence that SlippyNunchucks is associated with a nation-state surveillance effort aligned with the interests of the Chinese government.
SlippyNunchucks targets organizations and individuals across multiple sectors, and we discovered significant surveillance activity against an organization operating Chinese-language online betting platforms in Sri Lanka, Hong Kong, and the Philippines. The targeting of this organization is notable given China’s restrictions on gambling, including criminal penalties for operating gambling businesses and organizing Chinese citizens to gamble abroad. Combined with the broader victimology, this targeting pattern further supports our assessment that SlippyNunchucks is aligned with Chinese state interests.
This follows a pattern that we have observed in several operations in which China-aligned APT groups appear to support law enforcement actions against Chinese individuals linked to fraud schemes in the region. The activities come amid increased efforts by Chinese authorities to crack down on Southeast Asia’s scam industry, driven in part by growing domestic pressure over Chinese nationals being lured to neighboring countries and forced to work in scam compounds.
Campaign overview
Beginning on July 1st, 2026, we observed that victims in Hong Kong, Thailand, Japan, Vietnam, Sri Lanka, and Oman were receiving the DarkVigil implant while using Sogou Input Method. Initially, the volume of compromises and the geographic diversity of the victims gave the impression that an exploit might be involved. However, further investigation revealed a DNS hijacking operation that abused the application’s use of insecure HTTP communications. The point at which the DNS manipulation occurs remains unknown, leaving the hijacking vector unresolved. Suspected possibilities include compromised routers with modified and malicious DNS configurations, routers compromised with an implant that hijacks DNS requests, or interception at the ISP level.
Sogou Input Method (also known as Sogou Pinyin) is one of the most widely used Chinese input method editors (IMEs) for typing Chinese characters on computers and mobile devices (see Figure 2). It was launched in 2006 by Sogou, originally part of Sohu, and is now owned by Tencent following Tencent’s acquisition of Sogou in 2021.
Figure 2. User interface of Sogou Input Method
This popular IME has previously appeared in threat intelligence investigations, including a Citizen Lab analysis in 2023 of vulnerabilities that could allow a network eavesdropper to decrypt sensitive communications, and the recent Gen Threat Labs disclosure of the remote code execution vulnerability CVE‑2026‑51990.
Sogou Input Method uses specialized collections, known as cell dictionaries (细胞词库), to expand its vocabulary and improve Chinese text prediction. In April 2016, Sogou introduced the Startup Brand Support Program (创业品牌支持计划), allowing startup companies to submit their brand names for inclusion in the IME’s vocabulary. Once approved, these names could appear directly in the candidate list when users typed the corresponding pinyin, accompanied by a small green sprout icon (新芽) to distinguish them from ordinary vocabulary entries.
The request hijacked by SlippyNunchucks is associated with this brand promotion mechanism. Specifically, it retrieves a configuration for downloading icons associated with branded cell dictionaries, including the green sprout icon.
On October 29th, 2026, Tencent released version 16.10, which addresses the issue by migrating the affected HTTP requests to HTTPS. This change mitigates the risk of malicious configuration delivery through DNS hijacking by enforcing TLS certificate validation.
