- Si ce 2025, ESET has bee t acki g the Da kVigil malwa e ecosystem a d its ope ato ; SlippyNu chucks is the ame that ESET has assig ed to the associated APT g oup behi d the attack.
- ESET Resea ch has discove ed a DNS hijacki g ope atio by this g oup. The ope atio abuses Sogou I put Method’s app use of i secu e HTTP commu icatio s.
- Acco di g to ESET telemet y, this ope atio ta geted o ga izatio s a d Chi ese-speaki g i dividuals i Ho g Ko g, Thaila d, Japa , Viet am, Oma , a d S i La ka.
- Te ce t, the app’s develope , espo ded p omptly a d eleased a patch to add ess the CVE-2026-120422 vul e ability.
BRATISLAVA, Slovakia a d MONTREAL, Nov. 04, 2026 (GLOBE NEWSWIRE) — ESET Resea ch has discove ed a d a alyzed a DNS hijacki g ope atio abusi g i secu e HTTP commu icatio s i Wi dows ve sio s of Sogou I put Method, a Chi ese-la guage i put method edito developed by Te ce t. The Chi a-alig ed SlippyNu chucks APT g oup is behi d this latest su veilla ce campaig . As the ope ato of the Da kVigil malwa e ecosystem, it has ta geted o ga izatio s a d Chi ese-speaki g i dividuals i Ho g Ko g, Thaila d, Japa , Viet am, Oma , a d S i La ka. SlippyNu chucks has also bee able to each use s ac oss Asia a d Eu ope.
“I July 2026, we obse ved Da kVigil impla ts bei g lau ched by the Sogou I put Method compo e t SGTool.exe. Fu the i vestigatio evealed that a equest, which belo gs to the applicatio ’s b a ded vocabula y p omotio mecha ism, was hijacked to se ve a malicious co figu atio . This co figu atio i st ucts the bi a y to place the payloads i selected locatio s that e able thei executio th ough Sogou I put Method’s existi g wo kflows,” said ESET esea che A h Ho, who discove ed the ope atio a d vul e ability. “SGTool.exe is a legitimate Sogou I put Method compo e t that fu ctio s as a multipu pose task dispatche ,” he added.
Sogou I put Method (also k ow as Sogou Pi yi ) is o e of the most widely used Chi ese i put method edito s fo typi g Chi ese cha acte s o compute s a d mobile devices; it has p eviously appea ed i th eat i tellige ce i vestigatio s.
Sho tly afte u cove i g the ope atio , ESET co tacted the Te ce t Secu ity Respo se Ce te to epo t the abuse a d sha e its fi di gs. Te ce t espo ded p omptly a d eleased a patch to add ess the CVE-2026-120422 vul e ability. The app’s 16.10 ve sio add esses the issue by mig ati g the affected HTTP equests to HTTPS. This cha ge mitigates the isk of malicious co figu atio delive y th ough DNS hijacki g by e fo ci g TLS ce tificate validatio .
ESET Resea ch has bee t acki g the Da kVigil toolset (o FDMTP) si ce ea ly 2025. The ame Da kVigil is de ived f om the malwa e f amewo k’s i te al ame, Vigil, which appea s i lib a y efe e ces. Additio ally, ESET discove ed the web admi ist atio pa el used to ma age data exfilt ated by the impla t. The pa el displays a logo bea i g the Vigil ame.
SlippyNu chucks has bee active si ce at least 2023, with cybe espio age activities ce te i g o the deployme t a d ope atio of the Da kVigil toolset (also k ow as FDMTP). The g oup mai ly ta gets o ga izatio s a d Chi ese-speaki g i dividuals ac oss South a d East Asia. Occasio ally, the g oup has ta geted victims i Eu ope, i cludi g i dividuals i Ge ma y, Russia, the UK, a d Aust ia. Notable victims i clude a multi atio al gambli g o ga izatio that ope ates out of S i La ka, the Philippi es, a d Ho g Ko g; a i te et café i Dubai; a d a u ive sity stude t i De ma k.
I ESET telemet y, Da kVigil- elated activity fo ms a disti ct cluste i dicative of a APT g oup whose ope atio s ce te o the deployme t a d use of this toolset. ESET t acks this th eat acto as SlippyNu chucks. Co t a y to public epo ti g that att ibutes Da kVigil to Musta g Pa da (also k ow as Twill Typhoo ), ESET telemet y has ot evealed a y ove laps betwee Da kVigil- elated activity a d Musta g Pa da activity.
Fo mo e details about SlippyNu chucks a d its latest campaig , check out the ESET Resea ch blogpost “SlippyNu chucks hijacks Sogou I put Method’s b a d p omotio mecha ism to dist ibute malwa e,” o WeLiveSecu ity.com. Make su e to follow ESET Resea ch o Twitte (today k ow as X), BlueSky, a d Mastodo fo the latest ews f om ESET Resea ch.
ESET p otects o ga izatio s, c itical i f ast uctu e, a d i dividuals, helpi g them build digital esilie ce a d co fide ce i a i c easi gly AI-d ive wo ld. With mo e tha 35 yea s of cybe secu ity expe tise, ove 25 yea s of AI i ovatio , a d 11 global R&D ce te s, ESET develops p op ieta y tech ologies desig ed to p otect agai st evolvi g cybe th eats a d secu e the b oade AI ecosystem. G ou ded i scie tific igo a d taki g a p eemptive app oach to secu ity, ESET delive s effo tless p otectio that emai s u de expe t huma ove sight. Headqua te ed i the Eu opea U io a d p ivately ow ed, ESET p otects millio s of use s a d mo e tha 500,000 o ga izatio s ac oss 178 cou t ies. Committed to espo sible AI a d custome t ust, ESET p otects the p og ess that tech ology e ables. Fo mo e i fo matio , visit www.eset.com o follow ESET’s social media, podcasts, a d blogs.
CONTACT: Media co tact:
Jessica Beffa
jessica.beffa@eset.com
720-413-4938
