A China-aligned threat actor, SlippyNunchucks, has been linked to a DNS hijacking operation exploiting vulnerabilities in Windows versions of the Sogou Input Method. This operation is part of a broader surveillance campaign deploying an implant known as DarkVigil, also referred to as FDMTP.
The campaign began on July 1, 2026, targeting organizations and Chinese-speaking individuals in Hong Kong, Thailand, Japan, Vietnam, Oman, and Sri Lanka. SlippyNunchucks has been active since at least September 2023, with ESET tracking the group and its toolset since 2025.
The attack exploits the Sogou Input Method's branded vocabulary promotion mechanism to serve a malicious configuration. This configuration directs the binary to download additional payloads and execute malware through DLL sideloading.
Tencent addressed the vulnerability, identified as CVE-2026-120422, in version 16.10 of the Sogou Input Method, released on October 29, 2026. The campaign's targeting of a gambling organization in Sri Lanka, Hong Kong, and the Philippines is notable due to China's gambling restrictions.
DarkVigil is distinguished by its use of the Duplex Message Transport Protocol (DMTP) for command-and-control communications. The confirmed exploitation highlights the ongoing threat posed by SlippyNunchucks in the region.