SlippyNunchucks and the Sogou Trap: How a Chinese IME's HTTP Gap Became a Nation-State Espionage Vector
Beginning July 1, 2026, the China-aligned APT group SlippyNunchucks exploited an unencrypted HTTP endpoint within Sogou Input Method's brand promotion mechanism to deliver the DarkVigil espionage implant (also tracked as FDMTP) to victims across Hong Kong, Thailand, Japan, Vietnam, Oman, and Sri Lanka. By hijacking DNS resolution of config.pinyin.sogou[.]com and redirecting traffic to attacker-controlled staging servers, SlippyNunchucks served a malicious AES-256-CBC encrypted configuration that instructed the legitimate SGTool.exe component to download and side-load the DarkVigil implant via DLL hijacking. The group had previously abused the QuickFox supply chain before pivoting to this DNS hijacking technique. Tencent released a patched version (16.10) on October 30, 2026, migrating the affected requests to HTTPS with certificate pinning. This incident highlights a growing trend among China-aligned APT actors of weaponizing trusted, widely installed software used by Chinese-speaking diaspora communities to conduct persistent surveillance. The abuse of legitimate application update and configuration mechanisms—rather than zero-day exploits—underscores the difficulty of detecting such campaigns and the critical importance of enforcing encrypted transit for all application communications.
Kill Chain
