SlippyNunchucks APT hijacks Sogou Input Method in DNS attack
ESET Research has uncovered a DNS hijacking operation by SlippyNunchucks, a China-aligned advanced persistent threat group, which abused insecure HTTP communications in the Windows version of Sogou Input Method to deliver malware to targeted organisations and individuals. The campaign, identified by ESET in July 2026, exploited a vulnerability in SGTool.exe, a legitimate component of the widely used Chinese-language input method editor developed by Tencent.
ESET researcher Anh Ho, who discovered both the operation and the underlying vulnerability, described the technique in detail. "In July 2026, we observed DarkVigil implants being launched by the Sogou Input Method component SGTool.exe," he said. "Further investigation revealed that a request, which belongs to the application's branded vocabulary promotion mechanism, was hijacked to serve a malicious configuration. This configuration instructs the binary to place the payloads in selected locations that enable their execution through Sogou Input Method's existing workflows." SGTool.exe is a standard task dispatcher within the app, making it a low-suspicion vector for payload delivery.
The attack and affected regions
According to ESET telemetry, the campaign targeted organisations and Chinese-speaking individuals in Hong Kong, Thailand, Japan, Vietnam, Oman, and Sri Lanka. SlippyNunchucks has also reached victims in Europe, including individuals in Germany, Russia, the UK, and Austria. Named victims in ESET's reporting include a multinational gambling organisation operating across Sri Lanka, the Philippines, and Hong Kong; an internet café in Dubai; and a university student in Denmark.
The group has been active since at least 2023, operating primarily through the DarkVigil toolset, also tracked as FDMTP. ESET notes that its telemetry does not support public reporting attributing DarkVigil activity to Mustang Panda (also known as Twill Typhoon), and treats SlippyNunchucks as a distinct threat cluster.
Tencent responded promptly once ESET notified its Security Response Centre. The company released a patch addressing CVE-2026-120422, with Sogou Input Method version 16.10 migrating the affected HTTP requests to HTTPS and enforcing TLS certificate validation, which closes the DNS hijacking vector used to deliver the malicious configuration.
Market and threat landscape context
The campaign illustrates a recurring supply-side attack pattern: rather than directly compromising a target's infrastructure, threat actors intercept update or configuration traffic from widely installed software to gain persistent footholds. Sogou Input Method is one of the most widely deployed Chinese-language input editors globally, making it an attractive distribution channel for actors seeking reach across Chinese-speaking diaspora communities and organisations.
The incident arrives in a period of heightened attention on Chinese-linked APT activity. Western governments and cybersecurity agencies, including the UK's NCSC, the US CISA, and the EU's ENISA, have all issued advisories in recent cycles flagging state-aligned actors targeting critical sectors and individuals abroad. The EU's NIS2 Directive, which came into full effect across member states in late 2024, places new incident-reporting obligations on essential and important entities, meaning European organisations in affected sectors may have notification duties if DarkVigil implants are confirmed.
For security operations teams, the patch from Tencent provides the immediate remediation path. However, organisations running Sogou Input Method in managed environments should audit endpoint telemetry for prior DarkVigil indicators, given the campaign's reach back to at least early 2025. ESET has published full indicators of compromise and technical detail on its WeLiveSecurity blog, which security teams can use for retrospective hunting across SIEM and EDR platforms.