Cybersecurity researchers have uncovered a sophisticated supply chain and traffic hijacking campaign orchestrated by a China-aligned advanced persistent threat (APT) group known as SlippyNunchucks. The threat actors successfully weaponized the legitimate brand-promotion mechanism embedded within the popular Sogou Input Method—a widely used Chinese-language keyboard application owned by internet giant Tencent—to covertly deliver the modular DarkVigil malware toolset to unsuspecting users across multiple countries. The operation transformed routine application traffic into an active malware distribution channel, exposing critical vulnerabilities in how software applications fetch configuration data and highlighting the persistent risks associated with unencrypted network communications.
The campaign, which came to light following an exhaustive investigation by ESET security researcher Anh Ho, demonstrates the evolving ingenuity of state-sponsored surveillance operations. Rather than relying solely on traditional phishing vectors or zero-day exploits, SlippyNunchucks leveraged man-in-the-middle (MitM) techniques and Domain Name System (DNS) manipulation to intercept routine HTTP traffic. By hijacking the software update and promotion cycle of a trusted consumer application, the attackers achieved high-privilege persistence on victim machines while minimizing the friction typically required to compromise a target network.
Detailed technical analysis and threat intelligence assessments indicate that this activity aligns closely with broader geopolitical and domestic security interests prioritized by the Chinese government. As software supply chains become increasingly complex and interconnected, the SlippyNunchucks campaign serves as a stark reminder of the challenges software developers face in securing automated communication channels between client applications and corporate infrastructure.
Chronology of the SlippyNunchucks Campaign
The timeline reconstructed by ESET researchers provides a clear picture of how the SlippyNunchucks operation evolved from initial reconnaissance to full-scale deployment and subsequent remediation.
The earliest indicators of activity associated with the SlippyNunchucks group trace back to at least September 15, 2023. During this early phase, the threat actors experimented with alternative supply-chain compromise vectors, notably targeting QuickFox—a virtual private network and acceleration service tailored for overseas Chinese users. This initial campaign established the group’s operational capabilities in manipulating third-party software distribution channels to deploy payloads without raising immediate suspicion from endpoint security solutions.
The operational focus shifted significantly toward the Sogou Input Method ecosystem leading up to the summer of 2026. The primary malicious campaign officially commenced on July 1, 2026. Users of the Sogou Input Method in international jurisdictions began receiving unauthorized payloads containing the DarkVigil implant. Initially, the geographic dispersion and volume of the compromised endpoints baffled telemetry monitors, leading researchers to suspect that an undisclosed zero-day exploit in the application was actively being leveraged in the wild.
As telemetry data accumulated throughout the summer, ESET researchers mapped the mechanics of the compromise, culminating in a formal responsible disclosure report submitted to Tencent on September 11, 2026. Tencent acknowledged the security advisory ten days later, on September 21, initiating internal remediation efforts. By late October 2026, Tencent rolled out version 16.10 of the Sogou Input Method, which introduced critical security hardening measures, including HTTPS encryption and certificate pinning. The research findings were formally published to the broader cybersecurity community on November 4, 2026, shedding light on the mechanics of the attack and the attribution challenges surrounding the SlippyNunchucks collective.
Anatomy of the Attack: How Sogou Traffic Was Hijacked
The success of the SlippyNunchucks campaign relied on intercepting a benign feature built into the Sogou Input Method: its brand-promotion and configuration-fetching mechanism. Under normal operating conditions, a component within the Sogou application periodically queries a designated Sogou server to retrieve promotional content, updates, or configuration files necessary for the app’s auxiliary features.
Crucially, these routine requests were originally transmitted over unencrypted HTTP rather than secure HTTPS. This architectural choice left the communication channel vulnerable to interception and tampering by any actor positioned along the network path.
The threat actors exploited this vulnerability by employing DNS hijacking techniques. While ESET researchers were unable to definitively pinpoint the exact network location where the DNS manipulation occurred, they outlined several plausible vectors. These included compromised residential or enterprise routers configured with malicious DNS server settings, dedicated hardware implants installed at strategic routing chokepoints, or sophisticated traffic interception executed directly at the Internet Service Provider (ISP) level.
When affected Sogou users attempted to fetch their brand-promotion configuration, the hijacked DNS responses redirected the traffic away from legitimate Tencent infrastructure and toward attacker-controlled servers. In response, the malicious servers returned a forged, attacker-crafted configuration file.
This malicious configuration instructed the legitimate Sogou application component to download the DarkVigil implant from an external source. Once downloaded, the application automatically placed the payload into specific directories where Sogou’s own native components routinely executed code. By piggybacking on the application’s legitimate execution flow, the DarkVigil malware secured immediate persistence on the host machine without requiring a separate, standalone installation mechanism or triggering heuristic alerts reserved for abnormal executable drops.
Geographic Spread and Targeted Sectors
The reach of the SlippyNunchucks campaign spanned multiple international jurisdictions, primarily affecting users located in regions of strategic interest. Victims were identified across six distinct countries and territories: Hong Kong, Thailand, Japan, Vietnam, Sri Lanka, and Oman.
The targeting profile observed by ESET analysts was notably diverse, encompassing both broad consumer populations and highly specific enterprise entities. Among the identified victims were a multinational gambling organization operating across Sri Lanka, the Philippines, and Hong Kong; an internet café located in Dubai; and an individual university student residing in Denmark. Although ESET did not publish a comprehensive numerical tally of total infections, the geographic and sectoral spread indicates a targeted intelligence-gathering operation rather than indiscriminate mass malware distribution.
Of particular interest to threat intelligence analysts was the targeting of the multinational gambling sector. Researchers noted a strong correlation between these specific attacks and China’s ongoing, aggressive regulatory crackdowns on cross-border gambling operations. Beijing has long viewed offshore gambling networks operating in Southeast Asia and parts of South Asia as major conduits for capital flight, financial fraud, and organized crime targeting Chinese nationals. Consequently, the deployment of state-aligned spyware tools against gambling enterprises aligns with broader governmental directives supporting regional law enforcement and intelligence-gathering objectives against targeted economic sectors.
Attribution and the Nature of DarkVigil
DarkVigil, which is alternately tracked by other security firms under identifiers such as FDMTP, is a sophisticated, modular .NET-based toolset equipped with an extensive arsenal of more than 20 specialized plugins. These plugins allow operators to conduct comprehensive surveillance, execute arbitrary commands, harvest sensitive system information, and maintain long-term access to compromised environments.
The attribution of DarkVigil has been a subject of evolving analysis within the threat intelligence community. Prior to the exposure of the Sogou campaign, security firms such as Darktrace had linked FDMTP with moderate confidence to Mustang Panda, a well-known China-aligned APT group recognized for espionage campaigns targeting diplomatic, governmental, and telecommunications entities across Southeast Asia and Europe.
However, ESET’s telemetry and deeper analytical assessments diverged from this consensus. ESET explicitly stated that its observations revealed no direct operational overlap between the infrastructure or tactics used in the Sogou campaign and those traditionally attributed to Mustang Panda. As a result, ESET tracks the collective responsible for the Sogou traffic hijacking under the distinct moniker SlippyNunchucks, highlighting the complex and overlapping tool-sharing ecosystems frequently observed among state-sponsored Chinese cyber espionage actors.
Vendor Response and Remaining Vulnerabilities
Following ESET’s confidential disclosure on September 11, 2026, Tencent initiated corrective engineering work to secure the vulnerable components of the Sogou Input Method. The remediation culminated in the release of Sogou Input Method version 16.10 in late October 2026.
The primary update addressed the core architectural flaw exploited by SlippyNunchucks by transitioning the application’s configuration-fetching requests from unencrypted HTTP to secure HTTPS. Furthermore, the development team implemented certificate pinning—a security mechanism that prevents man-in-the-middle attacks by hardcoding or validating the specific cryptographic certificate expected from the server, ensuring that forged DNS responses cannot substitute unauthorized servers without immediate detection.
Despite these necessary patches, independent security analysis indicates that potential risks remain. ESET pointed out that while the communication transport layer has been secured against casual interception, the underlying downloader component within the application still lacks robust validation controls. Specifically, the downloader reportedly continues to operate without rigorously checking downloaded file types or restricting the file system directories where retrieved payloads are permitted to be saved. Security experts warn that if an attacker manages to compromise the server certificate infrastructure or discover secondary flaws in the application logic, similar abuse vectors could theoretically be engineered.
Broader Implications for Software Supply Chain Security
The SlippyNunchucks campaign against the Sogou Input Method underscores a critical, systemic vulnerability in modern software development: the inherent trust placed in automated background update and configuration mechanisms. Millions of consumers and enterprise employees routinely install applications developed by major technology conglomerates, assuming that standard consumer software is inherently shielded from sophisticated state-sponsored interference.
When threat actors compromise the delivery channels of widely deployed software—whether through supply chain manipulation, as seen in the earlier QuickFox incident, or via DNS and traffic hijacking—the attack surface expands exponentially. A single compromised configuration server can instantaneously convert millions of legitimate client installations into potential vectors for espionage and data exfiltration.
Furthermore, the incident highlights the ongoing challenges associated with unencrypted legacy protocols. Although major technology firms have largely migrated core services to HTTPS, auxiliary features, telemetry collectors, and brand-promotion modules in desktop applications frequently lag behind in security hardening. The willingness of APT groups to exploit these minor oversight gaps demonstrates that attackers continuously scan the periphery of major software ecosystems for low-resistance entry points.
As nation-state cyber operations become increasingly sophisticated and integrated with regional geopolitical objectives, software vendors face heightened pressure to implement rigorous security paradigms. Moving forward, comprehensive input validation, end-to-end encryption, strict certificate pinning, and proactive threat hunting within internal software update pipelines will be essential to defending against advanced campaigns like the one executed by SlippyNunchucks.
