SlippyNunchucks hijacks Sogou Input Method’s brand promotion mechanism to distribute malware

At ESET, we have been tracking the DarkVigil toolset (also known as FDMTP) and its operator, the SlippyNunchucks threat actor, since 2025. Across the campaigns we have analyzed, one behavior has remained consistent: DarkVigil implants are typically deployed through popular Chinese applications. By abusing these applications, the SlippyNunchucks threat actor has been able to reach Chinese-speaking users across Asia and Europe. Until now, how these applications are being abused to achieve execution has remained largely unclear.

So far, only one attack vector has been publicly identified: a compromise of the QuickFox supply chain. This incident was analyzed in a Fortinet article and independently in an ESET Threat Intelligence report. Shortly after the supply-chain compromise ended, SlipplyNunchucks shifted to abusing Sogou Input Method to deploy DarkVigil.

On July 1^st, 2026, three days after QuickFox released the clean version, we continued to observe DarkVigil implants being launched, this time by the Sogou Input Method component SGTool.exe. Further investigation revealed that a request, which belongs to the application’s branded vocabulary promotion mechanism, was hijacked to serve a malicious configuration. This configuration instructs the binary to place payloads in selected locations that enable their execution through Sogou Input Method’s existing workflows.

After uncovering the operation, we contacted the Tencent Security Response Center to report the abuse and share our findings. Tencent responded promptly and released an update to address the issue. We greatly appreciate the team’s swift response and cooperation.

Vulnerability disclosure timeline:

• 2026‑09‑11: ESET Research reported the security weakness to the Tencent Security team.
• 2026‑09‑21: Tencent Security responded and acknowledged the issue.
• 2026‑10‑30: Tencent addressed the issue in version 16.10.
• 2026-11-02: ESET CNA issued a CVE ID for the vulnerability (CVE-2026-120422).
• 2026‑11‑04: ESET Research published the blogpost.

Key points of this blogpost:

• Since 2025, we have been tracking the DarkVigil malware ecosystem and its operator, which we refer to as SlippyNunchucks.
• We uncovered a SlippyNunchucks DNS hijacking operation, abusing Sogou Input Method’s use of insecure HTTP communications.
• In our telemetry, we observed that this operation targeted organizations and Chinese-speaking individuals in Hong Kong, Thailand, Japan, Vietnam, Oman, and Sri Lanka.
• The point at which DNS manipulation occurs remains unknown.
• We analyzed DarkVigil’s C&C architecture, which uses the Duplex Message Transport Protocol.

SlippyNunchucks profile

SlippyNunchucks is a China-aligned threat actor that has been active since at least September 15^th, 2023. Its cyberespionage activities center on the deployment and operation of the DarkVigil toolset (also known as FDMTP). DarkVigil is a modular .NET toolset that includes the DarkVigil implant and more than 20 known plugins. The toolset is built on the Vigil malware framework, which is built on the TouchSocket networking framework. TouchSocket implements DMTP, a network protocol DarkVigil uses for C&C communications. Data exfiltrated by the malware is managed through a web administration panel that is also branded as Vigil.

SlippyNunchucks mainly targets organizations and Chinese-speaking individuals across South and East Asia. Occasionally, the group targeted victims in Europe, including individuals in Germany, Russia, the UK, and Austria. Notable victims include a multinational gambling organization that operates out of Sri Lanka, the Philippines, and Hong Kong; an Internet café in Dubai; and a university student in Denmark.

Context

ESET Research has been tracking the DarkVigil toolset (or FDMTP) since early 2025. The name DarkVigil is derived from the malware framework’s internal name, Vigil, which appears in library references such as using Vigil.Frame and using Vigil.Core, and in PDB paths such as:

• C:\Users\PT\Desktop\VigilPro\Client\Dotnet\Client.Core\[redacted]
• C:\Users\PT\Desktop\VigilⅢ\Client\Dotnet\Plugins\[redacted]

Additionally, we discovered the web administration panel used to manage data exfiltrated by the implant. The panel displays a logo bearing the Vigil name, as demonstrated in Figure 1.

In our telemetry, DarkVigil-related activity forms a distinct cluster indicative of a China-aligned APT group whose operations center on the deployment and use of this toolset. We track this threat actor as SlippyNunchucks.

Contrary to public reporting that attributes DarkVigil to Mustang Panda (also known as Twill Typhoon), our telemetry has not revealed any overlaps between DarkVigil-related activity and Mustang Panda activity. We assess that SlippyNunchucks is a distinct China-aligned APT group that we track independently and for which we currently have no known associations with Mustang Panda.

Since 2025, SlippyNunchucks has abused several Chinese applications, including Sogou Input Method, QuickFox, QingTalk, MiYunChat, SoftCam, and tawk.to, to deploy DarkVigil implants. This approach has enabled SlippyNunchucks to reach Chinese-speaking users abroad, particularly across Asia and Europe. Based on consistent patterns in the victimology and tactics, we assess with high confidence that SlippyNunchucks is associated with a nation-state surveillance effort aligned with the interests of the Chinese government.

SlippyNunchucks targets organizations and individuals across multiple sectors, and we discovered significant surveillance activity against an organization operating Chinese-language online betting platforms in Sri Lanka, Hong Kong, and the Philippines. The targeting of this organization is notable given China’s restrictions on gambling, including criminal penalties for operating gambling businesses and organizing Chinese citizens to gamble abroad. Combined with the broader victimology, this targeting pattern further supports our assessment that SlippyNunchucks is aligned with Chinese state interests.

This follows a pattern that we have observed in several operations in which China-aligned APT groups appear to support law enforcement actions against Chinese individuals linked to fraud schemes in the region. The activities come amid increased efforts by Chinese authorities to crack down on Southeast Asia’s scam industry, driven in part by growing domestic pressure over Chinese nationals being lured to neighboring countries and forced to work in scam compounds.

Campaign overview

Beginning on July 1^st, 2026, we observed that victims in Hong Kong, Thailand, Japan, Vietnam, Sri Lanka, and Oman were receiving the DarkVigil implant while using Sogou Input Method. Initially, the volume of compromises and the geographic diversity of the victims gave the impression that an exploit might be involved. However, further investigation revealed a DNS hijacking operation that abused the application’s use of insecure HTTP communications. The point at which the DNS manipulation occurs remains unknown, leaving the hijacking vector unresolved. Suspected possibilities include compromised routers with modified and malicious DNS configurations, routers compromised with an implant that hijacks DNS requests, or interception at the ISP level.

Sogou Input Method (also known as Sogou Pinyin) is one of the most widely used Chinese input method editors (IMEs) for typing Chinese characters on computers and mobile devices (see Figure 2). It was launched in 2006 by Sogou, originally part of Sohu, and is now owned by Tencent following Tencent’s acquisition of Sogou in 2021.

This popular IME has previously appeared in threat intelligence investigations, including a Citizen Lab analysis in 2023 of vulnerabilities that could allow a network eavesdropper to decrypt sensitive communications, and the recent Gen Threat Labs disclosure of the remote code execution vulnerability CVE‑2026‑51990.

Sogou Input Method uses specialized collections, known as cell dictionaries (细胞词库), to expand its vocabulary and improve Chinese text prediction. In April 2016, Sogou introduced the Startup Brand Support Program (创业品牌支持计划), allowing startup companies to submit their brand names for inclusion in the IME’s vocabulary. Once approved, these names could appear directly in the candidate list when users typed the corresponding pinyin, accompanied by a small green sprout icon (新芽) to distinguish them from ordinary vocabulary entries.

The request hijacked by SlippyNunchucks is associated with this brand promotion mechanism. Specifically, it retrieves a configuration for downloading icons associated with branded cell dictionaries, including the green sprout icon.

On October 29^th, 2026, Tencent released version 16.10, which addresses the issue by migrating the affected HTTP requests to HTTPS. This change mitigates the risk of malicious configuration delivery through DNS hijacking by enforcing TLS certificate validation.

Technical analysis

Analysis of the DNS hijacking

As part of Sogou Input Method’s brand promotion mechanism, SGTool.exe, one of its components, sends an HTTP request to the config.pinyin.sogou[.]com/api/brandScd/getBrandScd.php endpoint to retrieve a configuration for the icons associated with the branded cell dictionaries. In a clean environment, the endpoint responds with a config that is encrypted using AES‑256‑CBC with the key and IV embedded in the .rdata section of SGTool.exe. When decrypted, the config contains an instruction to download an icon of a small green sprout (tree.png), a symbol of the Startup Brand Support Program; see Figure 3.

SGTool.exe is a legitimate Sogou Input Method component that functions as a multipurpose task dispatcher. The binary parses a command ID supplied through the --appid= command line argument and routes execution to the corresponding application-specific handler. We identified at least 30 command IDs associated with functions such as IME installation, skin management, dictionary updates, Chromium Embedded Framework (CEF) downloads, and other operations.

Notably, in the execution pathway associated with --appid=scdreg -update, the SGTool.exe component invokes a handler that sends an HTTP request to config.pinyin.sogou[.]com/api/brandScd/getBrandScd.php to retrieve the configuration.

The domain config.pinyin.sogou[.]com is an official back-end host for Sogou Input Method. The domain is accessible over HTTPS and, when we accessed it, presented a valid TLS certificate for Tencent Technology (Shenzhen) Company Limited (SHA‑1: F4E0B9A3B3FA449DFC77A596B44B4560B4D05A57). By contrast, our analysis of SGTool.exe revealed 20 request endpoints on this host that the application accesses over unencrypted HTTP rather than HTTPS. These include the getBrandScd.php endpoint.

In the victims’ environments, the DNS resolution of config.pinyin.sogou[.]com was controlled by the attacker who resolved it to one of their staging servers – 47.239.250[.]102 or 47.237.122[.]175 – both of which served the attacker-controlled domain sogou-cdn[.]com. Subsequently, HTTP requests to the getBrandScd.php endpoint were directed to one of the staging servers, which responded with a malicious configuration.

The malicious configuration is encrypted in a manner similar to the legitimate one. Its decrypted content is shown in Figure 4.

This config instructs the binary to download two payloads from the staging servers behind sogou-cdn[.]com:

• the legitimate and signed Adobe Licensing WF Helper, renamed to biz_helper.exe (SHA‑1: 79188C8DE2378B437D39E867475C5B4714A0D7C9), and
• the DarkVigil implant libcef.dll.

The attacker modified the md5 fields to match the payloads, allowing for control of the integrity validation. The icon fields specify the destination paths for these files. The locations are selected to enable payload execution through one of two existing mechanisms:

• the component management utility SogouComMgr.exe, or
• the loading of the BizCenterCom component (see Figure 5).

Sogou Input Method manages components stored under \SogouInput\Components\ through a separate utility called SogouComMgr.exe, located in the same directory. SGTool.exe launches SogouComMgr.exe with command line arguments such as -installdoall <component_path>, -invoke <bundle> <component>, and -remove <component> to install a new component, load a component from a named bundle, or remove a component, respectively.

The malicious configuration instructs SGTool.exe to save the legitimate Adobe binary (biz_helper.exe) as \Components\SogouComMgr.exe. Consequently, whenever SGTool.exe attempts to install or load a component, it executes this Adobe binary instead. The disguised biz_helper.exe then side-loads the malicious \Components\libcef.dll, resulting in execution of the DarkVigil implant. By borrowing an existing workflow, this technique provides persistence without requiring a separate persistence mechanism.

If a software update overwrites SogouComMgr.exe, DarkVigil can still be executed through the payloads placed under \Components\biz_center\<version_number>\. In our analysis, we observed that SGTool.exe frequently launched SogouComMgr.exe with the command line argument -invoke BizCenterComBundle BizCenterCom, resulting in the execution of the disguised biz_helper.exe from the corresponding versioned directory under biz_center.

Similar to the previous mechanism, this approach does not require a separate persistence mechanism because it borrows Sogou Input Method’s component-loading workflow. However, it is sensitive to updates that introduce a new biz_center version, as the application may load components from a different versioned directory.

Because one method replaces the legitimate SogouComMgr.exe and the other relies on the legitimate binary, only one execution workflow can be achieved at a given time. Additionally, both methods are highly destructive and likely to cause software failures.

Following our disclosure, Tencent released version 16.10 on October 30^th, 2026. This update migrated the affected HTTP requests to HTTPS and enabled certificate pinning.

Analysis of DarkVigil network communication

The most interesting aspect of DarkVigil is its use of Duplex Message Transport Protocol (DMTP), a network protocol. In this section, we present our analysis of DarkVigil C&C communication using this protocol, as performed in 2025. Newer versions may have additional features or different method names; however, the inner workings should follow closely with our analysis.

DMTP is a binary data protocol that operates at the application layer of the OSI model. DMTP can be run on top of various protocols – including TCP, UDP, HTTP, WebSocket, and even on named pipes – making it extremely versatile for facilitating network communication.

For backdoor development, DMTP offers two capabilities that make it particularly suitable for C&C communication and plugin orchestration:

• a reverse remote procedure call (RPC) mechanism, and
• support for both server-client and client-client communication channels simultaneously.

In the next paragraphs, we examine the code of DarkVigil, using Figure 6 as a guide to demonstrate how these two features contribute to the uniqueness of DarkVigil’s network communication.

Connection life cycle

In the DarkVigil framework, both the client and the server must implement its own set of DMTP plugins (see Figure 6); each plugin is responsible for sending and processing DMTP messages throughout the various stages of the connection life cycle. Each DMTP plugin listens for a connection event and responds when that event is triggered. For example, the client-side HandshakePlugin (see Figure 7) listens for the OnDmtpHandshaked event, which is triggered when the DarkVigil client successfully connects to the C&C server. In response, the plugin initiates the conversation by sending over the victim’s profile.

Command request and response

DarkVigil issues and receives commands through RPC. Figure 7 shows an example of the client invoking the RPC method ClientInfo, passing an array of data containing the victim’s profile to the C&C server. The meaning of each argument is the following:

• ClientInfo – the RPC method implemented on the C&C server to process the victim’s profile,
• InvokeOption.WaitInvoke – a flag specifying that the client must wait for the completion response from the server, and
• array – a buffer containing the victim’s profile, passed as an argument to the ClientInfo call on the server.

In DarkVigil’s architecture, an RPC method – functionally similar to a command handler – is implemented on both ends of the connection. Invocations can be nested, for example, ClientInfo can invoke a client-side RPC method in its execution, and then the client-side method can trigger back another server-side method. This is the reverse RPC mechanism mentioned earlier and is handled by the DmtpRpcActor class, which we will refer to as the RPC actor.

When a DMTP message arrives, it is looked at by the DMTP plugins. If no plugin handles the message, it is passed on to the RPC actor for inspection. If the RPC actor finds the method name, it looks for the code in an RPC library referred to as RpcStore and executes it. RpcStore is where all RPC services are registered.

An RPC service is a collection of related RPC methods that serve a common goal. For example, the DarkVigil client implements two services (see Figure 8):

• PluginService – contains methods to manage and execute DarkVigil plugins, and
• OptionService – contains methods to disconnect or terminate the client.

Plugin orchestration

The primary purpose of the DarkVigil client is to execute and orchestrate plugins (external modules) that install persistence or perform data collection. PluginService (see Figure 8) provides tools for plugin orchestration.

The plugin life cycle begins with the C&C server pushing a plugin to the client using DMTP’s built-in file transfer capability. After the plugin is delivered, the server invokes the RegistryPlugin method, which stores the plugin’s compressed binary in the registry key HKCU\Software\Microsoft\IME\<HWID>\pluginHash. Finally, the server invokes the RunPlugin method, which decompresses the binary data retrieved from the registry key, loads it into the .NET environment, and invokes the Run method of the Plugin.Plugin class. At this point, the plugin is successfully executed.

In the Run method, the plugin receives two arguments: a pointer to the client’s DMTP connection, and a controlerID provided by the C&C server. Using these two arguments, the plugin establishes an indirect connection with the C&C server (see Figure 9), using the client as the relay. This design relies on DMTP’s ability to support both client-client and client-server communication channels simultaneously.

To request a connection with the C&C server, the plugin must provide a PluginID value (see Figure 9), which is generated from concatenating the following elements:

• ProtocolType – typically set to TcpDmtp.
• HWID – an ID number generated by the client using a combination of hardcoded mutex and the victim’s information such as username, machine name, MAC address, and so on.
• controlerID – an ID provided by the C&C server, using the prefix Server.
• randomID – a pseudorandomly generated number.
• PluginName – in this example, the plugin is called Pillager.

When the connection is established, the plugin can invoke any client-side or server-side RPC method, using a relay function called SendPluginMsg, as shown in Figure 10.

When the plugin passes a targetID argument to SendPluginMsg, the client invokes the server-side RPC method and forwards back the response. If targetID is not included, the client looks within its own RpcStore library for the method and then executes it.

Network protocol

DMTP uses a simple message structure consisting of four sections: header, flag, length, and data. The size and description of each section is given in Table 1.

Table 1. DMTP packet structure

Figure 11 shows the first few messages between DarkVigil and the C&C server. DarkVigil initiates the connection by sending a DMTP handshake request, which includes:

• an authentication token – the default token Dmtp was used,
• metadata – no metadata was specified,
• a proposed ID – an instance ID that has the format <internal_name>.<protocol_type>:<HWID>, and
• other framework-generated arguments.

In return, the server responds with a globally unique ID assigned to the client, completing the DMTP handshake. In this case, the C&C server accepts and reuses the ID requested by the DarkVigil client. At this point, the connection has been established, and HandshakePlugin is activated to start the application-level handshake. In the next network message, DarkVigil invokes ClientInfo – the server-side RPC method – which receives the victim’s information.

Conclusion

In this blogpost we described a surveillance method used to target Chinese speakers abroad. By abusing insecure network communication used in the widely popular Chinese input method editor Sogou Input Method, SlippyNunchucks was able to deploy an implant to victims across Asia and Europe. The threat actor intercepts DNS resolution in the victims’ environments via an undiscovered method, to direct some HTTP traffic generated by Sogou Input Method to an attacker-controlled server. When the application asks for the configuration to download icons associated with branded cell dictionaries, this server responds with a malicious configuration instructing the download of payloads to selected locations. This allows the abuse of Sogou Input Method’s existing component management workflows, resulting in the execution of the DarkVigil implant.

For any inquiries about our research published on WeLiveSecurity, please contact us at threatintel@eset.com. 

ESET Research offers private APT intelligence reports and data feeds. For any inquiries about this service, visit the ESET Threat Intelligence page.

IoCs

A comprehensive list of indicators of compromise (IoCs) and samples can be found in our GitHub repository.

Files

Network

MITRE ATT&CK techniques

This table was built using version 20 of the MITRE ATT&CK framework.