SlippyNunchucks hijacks Sogou to deploy DarkVigil backdoor

A China-aligned threat actor known as SlippyNunchucks has been linked to a DNS hijacking operation that targets Windows versions of Sogou Input Method to deliver a backdoor called DarkVigil (also referred to as FDMTP). The operation, observed from 1 July 2026, leverages insecure HTTP communications to maliciously override a configuration fetch.

ESET notes the attack redirects requests meant for the brandScd.php endpoint to two staging servers, enabling the adversary to push a corrupted configuration and ultimately deploy DarkVigil via DLL sideloading of a legitimate Sogou component (SGTool.exe) using a rogue libcef.dll. The draft configuration instructs the download of two payloads from sogou-cdn[.]com to activate the malware.

According to ESET, the backdoor communicates using the Duplex Message Transport Protocol (DMTP) for C2 and supports a modular, plugin‑based extension framework. Tencent addressed the exposed HTTP traffic by updating to HTTPS in Sogou Input Method version 16.10, released on 29 October 2026, in response to CVE-2026-120422.

The researchers also tie DarkVigil to a broader surveillance-focused intrusion set believed to operate in service of Chinese state interests, with targeted victims including Chinese-speaking organisations in Hong Kong, Sri Lanka, and elsewhere in Asia and Europe. This campaign follows prior activity linking related toolchains to Mustang Panda, though ESET found no direct tactical overlap with prior DarkVigil deployments.

Earlier reporting notes related exploits in the Sogou ecosystem have included CVE-2026-51990 (UNC3569) and other, older chain weaknesses, including CVE-2021-38003.