China-aligned SlippyNunchucks hijacks Sogou Input Method DNS requests to deploy DarkVigil implant, ESET says

TLDR

• ESET says China-aligned SlippyNunchucks redirected a Sogou Input Method request via DNS hijacking to deliver the DarkVigil implant.¹²
• ESET saw victims in Hong Kong, Thailand, Japan, Vietnam, Oman and Sri Lanka; the DNS manipulation point is unknown.¹
• Tencent fixed the flaw (CVE-2026-120422) in Sogou Input Method 16.10 by moving the affected requests to HTTPS.¹⁴

ESET Research says a China-aligned threat actor it tracks as SlippyNunchucks abused the insecure HTTP communications of Windows versions of Sogou Input Method, a Chinese-language input method editor owned by Tencent, to deliver the DarkVigil implant, also known as FDMTP.¹⁴ ESET says it began observing victims receiving the implant while using Sogou Input Method on 1 July 2026, three days after QuickFox released a clean version of its software following an earlier supply-chain compromise.¹ ESET published its research on 4 November 2026.¹

According to ESET, a Sogou component named SGTool.exe requests a configuration from a Sogou server over unencrypted HTTP as part of the app's branded vocabulary promotion mechanism.¹ In the victims' environments, the attacker controlled DNS resolution for that host and pointed it to one of two staging servers, which returned a malicious configuration.¹ ESET says that configuration told the app to download two payloads, a legitimate signed Adobe executable and a rogue DLL containing DarkVigil, and place them where Sogou's own component workflows would run them.¹ Infosecurity Magazine reports that this gave the malware persistence without a separate mechanism.² ESET says it does not know where the DNS manipulation occurs, and lists compromised routers with malicious DNS settings, routers implanted to hijack DNS requests, and interception at the ISP level as suspected possibilities.¹

ESET says it assesses with high confidence that SlippyNunchucks, active since at least 15 September 2023, is associated with a nation-state surveillance effort aligned with the interests of the Chinese government.¹ It bases this on consistent victimology and tactics, including surveillance of an organisation operating Chinese-language online betting platforms in Sri Lanka, Hong Kong and the Philippines.¹ ESET says its telemetry shows no overlap with Mustang Panda, to which public reporting had attributed DarkVigil, and it tracks the group as distinct.¹³ Beyond the six countries above, ESET says the group has occasionally targeted individuals in Germany, Russia, the UK and Austria, and names an internet café in Dubai and a university student in Denmark among its victims.¹ Infosecurity Magazine notes that ESET gave no victim count.²

ESET says it reported the weakness to Tencent on 11 September and that Tencent released version 16.10, which moves the affected requests to HTTPS and enables certificate pinning.¹ The sources differ on the release date: The Hacker News gives 29 October 2026, while ESET's blog post gives both 29 and 30 October, and Infosecurity Magazine says only "late October".¹²³ ESET's CVE numbering authority issued CVE-2026-120422 on 2 November.¹ Infosecurity Magazine reports that ESET flagged the downloader component as still not validating downloaded file types or restricting where files are saved, a point The Hacker News and ESET's own blog post do not mention.²

Why it matters: a widely used input method that fetched configuration over plain HTTP gave a DNS-level attacker a route to run code on victims' machines, and ESET says it still does not know where the hijacking took place.¹²