A China-aligned hacking group known as SlippyNunchucks has been found exploiting a security weakness in Sogou Input Method, a popular Chinese-language typing application for Windows, to distribute dangerous malware called DarkVigil, also known as FDMTP. According to cybersecurity researchers at ESET, the attackers manipulated DNS requests and took advantage of the application’s insecure HTTP communications to deliver malicious configurations. The campaign was first observed on July 1, 2026, and primarily targeted organizations and Chinese-speaking individuals across Hong Kong, Thailand, Japan, Vietnam, Oman, and Sri Lanka. Researchers believe the operation is part of a broader cyberespionage campaign focused on surveillance and information gathering.
The attackers specifically abused Sogou Input Method’s branded vocabulary promotion feature, which normally retrieves configuration information from the application’s servers. Under normal conditions, a legitimate component called SGTool.exe sends an HTTP request to obtain this information. However, researchers discovered that attackers manipulated DNS resolution, redirecting these requests to their own servers instead of the legitimate Sogou infrastructure. This allowed them to return a specially crafted malicious configuration that instructed the application to download additional files onto the victim’s computer.
Once the malicious configuration was received, SGTool.exe was instructed to download two additional files from attacker-controlled servers. These included a legitimate Adobe executable named biz_helper.exe and a malicious DLL file called libcef.dll containing the DarkVigil backdoor. The attackers then used a technique known as DLL sideloading, where a legitimate application is tricked into loading a malicious library instead of its intended file. This technique helped the malware execute through trusted software components, making the attack more difficult to identify through ordinary security checks.
DarkVigil is a modular .NET-based malware framework that uses the Duplex Message Transport Protocol (DMTP) to communicate with attacker-controlled servers. Researchers found that the framework contains more than 20 plugins that can support different malicious activities, including maintaining access to infected systems and collecting information. ESET has been tracking this malware ecosystem since early 2025 and identified SlippyNunchucks as the threat group operating it. Although DarkVigil was previously associated with another China-linked group called Mustang Panda, ESET reported that its investigation found no tactical overlaps between the two groups in its telemetry.
Researchers also discovered that SlippyNunchucks had previously abused other applications, including QuickFox, QingTalk, MiYunChat, SoftCam, and tawk.to, to reach potential victims. Earlier in August 2026, Fortinet’s FortiGuard Incident Response Team reported that the group had compromised the QuickFox VPN and network acceleration application to distribute DarkVigil. ESET also observed significant surveillance activity against an organization operating Chinese-language online betting platforms in Sri Lanka, Hong Kong, and the Philippines. These findings indicate that the attackers have been using multiple popular applications to expand their reach across different regions and sectors.
Following responsible disclosure from ESET, Tencent, the developer of Sogou Input Method, addressed the security issue under the identifier CVE-2026-120422. The company released version 16.10 on October 29, 2026, moving the affected HTTP requests to HTTPS to protect configuration downloads through encrypted communication and TLS certificate validation. Users are advised to update Sogou Input Method to version 16.10 or later to reduce the risk of this attack. The incident highlights how even widely used and trusted applications can become entry points for cyberattacks when their communication mechanisms are not properly secured.
Stay alert, and keep your security measures updated!
Source: Follow cybersecurity88 on X and LinkedIn for the latest cybersecurity news
