On July 1, 2026, users of Sogou Input Method began receiving DarkVigil implants after the keyboard app’s brand‑promotion mechanism was turned into a malware distribution channel, ESET researcher Anh Ho reported on November 4.
SlippyNunchucks and the DarkVigil toolset
ESET named the operator SlippyNunchucks and assessed with high confidence that the group is “associated with a nation‑state surveillance effort aligned with Chinese government interests.” The delivered malware, DarkVigil (also tracked as FDMTP), is a modular .NET toolset with more than 20 plugins. Darktrace previously linked FDMTP to Mustang Panda with moderate confidence; ESET said its telemetry shows no overlap between Mustang Panda and the activity it attributes to SlippyNunchucks, and ESET tracks SlippyNunchucks separately.
Before this campaign, ESET noted the group’s only publicly identified distribution method was a supply‑chain compromise of QuickFox. ESET also tied the campaign’s gambling‑sector targeting to China’s gambling restrictions and to China‑aligned groups’ apparent support for law‑enforcement action against Chinese individuals tied to regional fraud.
Hijacking Sogou’s brand‑promotion channel via DNS manipulation
According to ESET’s analysis, a Sogou component fetched a brand‑promotion configuration from a Sogou server using unencrypted HTTP. Attackers used DNS hijacking to redirect those requests to attacker‑controlled servers, which returned a malicious configuration. That configuration caused the app to download the DarkVigil implant and place it where Sogou’s own components would run it, granting the implant persistence without a separate persistence mechanism.
ESET said it does not know where the DNS manipulation occurred. It listed possible locations for the manipulation: routers configured with malicious DNS settings, routers implanted to hijack DNS, or interception at the internet service provider level.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageVictims in Hong Kong, Thailand, Japan, Vietnam, Sri Lanka and Oman — and other notable cases
ESET reported victims in Hong Kong, Thailand, Japan, Vietnam, Sri Lanka and Oman. The company also said victims included a multinational gambling organization operating from Sri Lanka, the Philippines and Hong Kong, an internet café in Dubai, and a university student in Denmark. ESET did not provide a total victim count.
The geographic spread and variety of targets initially led ESET to suspect an exploit; the eventual chain it described depended instead on the abused HTTP request and DNS redirection.
Tencent’s patch in version 16.10 and the remaining gaps
ESET reported the issue to Tencent on September 11; Tencent acknowledged the report on September 21. Sogou Input Method version 16.10, released in late October, moved the affected requests to HTTPS and enabled certificate pinning. Those changes close the unencrypted request the attackers exploited to deliver a malicious configuration.
However, ESET said the downloader component still does not validate downloaded file types or restrict where files are saved. In other words, while the update removed the unencrypted HTTP vector, components that fetch and write files remain permissive enough that a malicious configuration could still place and execute undesired binaries if an attacker again controls the configuration channel. Where the DNS hijacking occurred remains unknown.
How Tencent, gambling‑sector organizations, and security teams are affected
- Tencent: The company has patched the immediate HTTP weakness in Sogou Input Method (version 16.10), enabling HTTPS and certificate pinning, but ESET’s findings point to residual downloader design gaps that may require additional hardening or validation.
- Gambling‑sector organizations operating regionally: ESET linked sector targeting to China’s gambling restrictions and broader law‑enforcement dynamics; organizations that operate across Sri Lanka, the Philippines and Hong Kong should note their inclusion among named victims.
- Security teams and incident responders: The chain combined an application’s legitimate update/brand‑promotion behavior with DNS manipulation and a permissive downloader. Teams should treat DNS integrity and downloader validation as distinct control points, since the patch addressing HTTPS does not eliminate the download/placement risks ESET flagged.
ESET’s November 4 research by Anh Ho lays out a compact but consequential picture: attackers hijacked a legitimate app channel via DNS manipulation, used it to deliver a sophisticated modular implant, and succeeded in placing that implant where the app itself would run it. Tencent’s October update removed the unencrypted transport that enabled the abuse, but ESET’s confirmation that the downloader still lacks type validation and save‑location restrictions — and the unresolved question of where DNS hijacking occurred — leave tangible avenues for future abuse. The research also frames the operation as part of a China‑aligned, nation‑state surveillance effort, a linkage ESET judged with high confidence.
