Skip to content
securitytabs

LiveUpdated

ESET: China-Aligned SlippyNunchucks Hijacks Sogou Input Method Traffic to Spread Backdoor

Security firm ESET says a China-aligned hacking group redirected internet requests from the Windows version of the Sogou Input Method typing software to install spyware. Organizations that use the software should treat it as a possible entry point; no fix has been described.

Sogou Input Method traffic hijacked to spread backdoor
Sogou Input Method traffic hijacked to spread backdoor

What's new

Newest coverage

TimelineWhat should my organization do?

What happened

ESET Research says a group it calls SlippyNunchucks ran a DNS hijacking operation (tampering with the lookups that tell a device where to connect) that abused insecure HTTP communications in Windows versions of Sogou Input Method. ESET describes the abused feature as the software's brand promotion mechanism. [1][2]

The Hacker News reports that the China-aligned actor used the hijacking in a surveillance campaign to deploy an implant called DarkVigil, also known as FDMTP. It reports the campaign was observed starting July 1, 2026. [3]

What is not yet known

The available articles do not give victim counts, a vendor patch, or published mitigation steps beyond ESET's own research. [1][3][2]

Timeline

  1. ESET's research described the abuse of Sogou Input Method's brand promotion mechanism. [2]

  2. ESET published its analysis of the SlippyNunchucks operation. [1]

  3. The SlippyNunchucks campaign was first observed, according to the research summary. [3]

Explained

The technology and terms in this story. Learn more

Business ActionWhat this means inside your organization, and what to do about it, by company size.

Small business

No dedicated security staff; relies on providers

What to know

ESET says the campaign abused the Windows version of Sogou Input Method; no fix or indicators are described in the available excerpts. [1][3]

What to do

  1. Ask your IT provider whether Sogou Input Method is installed on any of your Windows computers. [1]
  2. Ask your provider to review ESET's published analysis. [1]

Mid-size company

A small IT or security team

What to know

The operation used insecure HTTP communications in the Windows software to deliver the DarkVigil implant, ESET says. [1][3]

What to do

  1. Check your asset inventory for Sogou Input Method on Windows endpoints. [1]
  2. Compare the indicators in ESET's analysis with DNS and endpoint logs. [1]

Large enterprise

A security operations team

What to know

ESET attributes the surveillance campaign to a China-aligned actor and says it abused the software's brand promotion mechanism. [1][2]

What to do

  1. Hunt for Sogou Input Method installations and for DarkVigil (FDMTP) activity using ESET's published details. [1][3]
  2. Review DNS logs for the software's update and promotion traffic for signs of tampering. [1]

Sources

  1. [1]ESET WeLiveSecurity · Nov 4, 09:55 UTC
    SlippyNunchucks hijacks Sogou Input Method’s brand promotion mechanism to distribute malwarecontext
  2. [2]Infosecurity Magazine · Nov 4, 15:00 UTC
    China-Aligned Group Abuses Sogou Input Method to Deliver Malwarecontext
  3. [3]The Hacker News · Nov 4, 11:24 UTC
    China-Aligned Hackers Hijack Sogou Input Method DNS Requests to Deploy DarkVigil Backdoorcontext