A cyber espionage campaign linked to a China-aligned group, known as SlippyNunchucks, has been linked to a sophisticated DNS hijacking operation. This campaign exploits the vulnerabilities in the Windows version of the Sogou Input Method to deploy a malware implant named DarkVigil. The operation has been active since July 2026 and primarily targets organizations and Chinese-speaking individuals across several Asian countries, according to cybersecurity firm ESET.
Details of the Cyber Attack
SlippyNunchucks has utilized popular Chinese applications like Sogou Input Method, QuickFox, and others to infiltrate networks across Asia and Europe. This threat actor, active since at least September 2023, is known for using a modular .NET framework to distribute DarkVigil alongside over 20 plugins. ESET’s analysis indicates no tactical similarities with other known groups like Mustang Panda, suggesting a distinctly different threat group.
The attack involves hijacking DNS requests for Sogou Input Method’s branded vocabulary promotion mechanism, redirecting these requests to malicious servers. This enables the delivery of harmful configurations and further payloads, activating malware through a process known as DLL sideloading.
Method of Exploitation
The compromised application, Sogou Input Method, originally communicates via HTTP to fetch configurations. During the attack, DNS tampering redirects requests to rogue servers, which supply malicious configurations. These configurations instruct the application to download additional components from “sogou-cdn[.]com” and execute the malware using a legitimate Adobe executable and a rogue DLL containing DarkVigil.
DarkVigil is recognized for its use of the Duplex Message Transport Protocol (DMTP) for command-and-control communications, enabling the execution and coordination of plugins from an attacker-controlled server.
Response and Implications
In response to this threat, Tencent released a patch (CVE-2026-120422) on October 29, 2026, upgrading the communication protocol from HTTP to HTTPS to mitigate the vulnerability. This incident underscores the ongoing risk posed by nation-state actors leveraging software vulnerabilities for surveillance, particularly in regions with strict regulations, such as China’s gambling restrictions.
Previous incidents have seen China-nexus actors exploiting similar vulnerabilities in Sogou Input Method. For instance, in September 2026, another group, UNC3569, exploited a different vulnerability for malware distribution. This highlights the persistent threat landscape and the need for continuous vigilance in cybersecurity practices.
As the situation evolves, organizations must remain alert to the tactics used by sophisticated threat actors like SlippyNunchucks, reinforcing the necessity for robust cybersecurity defenses and timely updates to software vulnerabilities.
