A China-aligned threat actor known as SlippyNunchucks has been attributed to a Domain Name System (DNS) hijacking operation abusing insecure HTTP communications in Windows versions of Sogou Input Method as part of a surveillance campaign designed to deploy an implant called DarkVigil (aka FDMTP).

The campaign, observed starting July 1, 2026, is assessed to have targeted organizations and Chinese-speaking individuals in Hong Kong, Thailand, Japan, Vietnam, Oman, and Sri Lanka, according to ESET.

"DarkVigil implants are typically deployed through popular Chinese applications," ESET researcher Anh Ho said in a report shared with The Hacker News. "By abusing these applications, the SlippyNunchucks threat actor has been able to reach Chinese-speaking users across Asia and Europe."

Some of the applications abused by the adversary include Sogou Input Method, QuickFox, QingTalk, MiYunChat, SoftCam, and tawk.to.

Active since at least September 15, 2023, SlippyNunchucks is known for targeting organizations and Chinese-speaking individuals across South and East Asia. These attacks led to the deployment of a modular .NET framework that includes DarkVigil and a set of over 20 plugins.

Although the use of the backdoor has been previously linked to Mustang Panda, ESET said it found no tactical overlaps between the threat actor and DarkVigil-related activity in its telemetry, prompting it to classify it as a distinct intrusion set.

Earlier this August, Fortinet's FortiGuard Incident Response Team detailed the threat actor's supply chain compromise of the QuickFox VPN and network acceleration tool to deliver DarkVigil.

According to the Slovakian cybersecurity company, the adversary shifted to exploiting Sogou Input Method, a popular Chinese-language input method editor developed by Tencent, as a delivery vector three days after QuickFox released a clean version of its program.

Source link