Cybersecurity Alert: China-Aligned Group Hijacks Sogou Input Method to Distribute Malware
A newly identified group, ominously known as SlippyNunchucks, has successfully hijacked the brand-promotion mechanism of the Sogou Input Method, a popular Chinese-language keyboard application owned by Tencent. This alarming development involves the distribution of a malware toolset called DarkVigil to users across six different countries, thus transforming what was once legitimate application traffic into a conduit for malware distribution.
Research conducted by ESET, a cybersecurity firm, shed light on this concerning trend. ESET researcher Anh Ho published findings on November 4, revealing that SlippyNunchucks has been active at least since September 15, 2023. The assessment made by ESET strongly suggests that this group is linked to a broader state-sponsored surveillance initiative aligned with Chinese government interests, indicating a sophisticated level of orchestration.
Origins of the Attack
The campaign originated on July 1, 2026, when users of Sogou Input Method began unwittingly downloading DarkVigil implants. The initial spread of victims across multiple geographic locations led ESET to initially suspect an exploit, pointing to highly coordinated malfeasance rather than random opportunism.
The Sogou Input Method fetched brand-promotion configurations from a Sogou server through unencrypted HTTP, creating a vulnerability. Domain Name System (DNS) hijacking played a crucial role in this attack, as perpetrators redirected these requests to servers they controlled. Instead of legitimate configurations, users received malicious code designed to install the DarkVigil implant, effectively embedding the malware into the infrastructure of the Sogou application itself. This method not only facilitated the initial download but also ensured the malware’s persistence, as it operated seamlessly where Sogou’s components were intended to run.
Global Impact
The ramifications of this attack are widespread, with victims located in Hong Kong, Thailand, Japan, Vietnam, Sri Lanka, and Oman. Among those affected are a multinational gambling organization headquartered in Sri Lanka, as well as an internet café in Dubai and a university student in Denmark. Despite the varied demographics of the victims, ESET has not disclosed specific numbers, which leaves unanswered questions about the scale of this campaign.
Tencent’s Response and Remaining Vulnerabilities
Following ESET’s report to Tencent on September 11, the tech giant acknowledged the issue ten days later, on September 21. In response, Tencent released a new version of the Sogou Input Method—version 16.10—at the end of October. This update included significant improvements, such as shifting the affected requests to HTTPS and implementing certificate pinning, which are crucial steps in enhancing security against such attacks.
However, ESET’s analysis has also highlighted lingering vulnerabilities. While the update effectively closed the door on the unencrypted requests that SlippyNunchucks capitalized on, the downloader component still lacks essential protections. Notably, it does not validate the types of files being downloaded nor restrict the locations where these files can be stored on user devices. This oversight presents ongoing risks, as malicious actors could potentially exploit these weaknesses in future operations.
Connections to Broader Cyber Threats
DarkVigil, also referred to as FDMTP, is a modular .NET toolset containing a suite of over 20 plugins, which allows for extensive customization and adaptability for various malicious objectives. ESET’s telemetry indicates that while DarkVigil shares some characteristics with other known malware, particularly FDMTP—which has been linked to another group known as Mustang Panda—the two are tracked separately, thus requiring different approaches to combat them.
Prior to targeting users via Sogou, SlippyNunchucks mainly relied on a supply-chain compromise involving QuickFox, another prominent application. The group’s activities are believed to be closely intertwined with the Chinese government’s regulatory efforts, especially regarding the gambling sector, as China has been ramping up its restrictions in this area. Additionally, there is speculation that these operations may align with law enforcement actions against individuals linked to regional fraudulent activities.
In summary, the ongoing activities of SlippyNunchucks represent a significant threat not only to individuals and organizations in the affected nations but also highlight the pressing need for robust cybersecurity measures. As sophisticated malware distribution strategies continue to evolve, users and software creators alike must remain vigilant in safeguarding their digital environments.