Actor Profile

SlippyNunchucks is a China-aligned threat actor active since at least September 15, 2023, assessed to operate in support of Chinese government interests. The group conducts nation-state surveillance operations targeting organizations and Chinese-speaking individuals across South and East Asia. SlippyNunchucks deploys a modular .NET framework centered on the DarkVigil backdoor (aka FDMTP) with over 20 plugins for persistence and data collection. ESET tracks this as a distinct intrusion set separate from Mustang Panda, despite previous associations of DarkVigil with that group. The actor demonstrates sophisticated supply chain compromise capabilities and targets sectors including technology, online gambling platforms, and Chinese diaspora communities.

TTPs (Tactics, Techniques, Procedures)

SlippyNunchucks employs DNS hijacking to intercept insecure HTTP communications in legitimate Chinese applications, redirecting traffic to attacker-controlled staging servers. The actor exploits branded vocabulary promotion mechanisms in Sogou Input Method (CVE-2026-120422) to deliver malicious configurations via SGTool.exe. Malware deployment leverages DLL side-loading using legitimate Adobe executables (biz_helper.exe) with rogue libcef.dll containing DarkVigil. The backdoor uses Duplex Message Transport Protocol (DMTP) for C2 communications and orchestrates modular plugins for persistence and data exfiltration. The group conducts supply chain compromises of popular Chinese applications including QuickFox VPN, QingTalk, MiYunChat, SoftCam, and tawk.to to reach Chinese-speaking users across Asia and Europe. Key techniques align with initial access via supply chain compromise, execution through DLL side-loading, and C2 via custom protocols.

Targets & Patterns

SlippyNunchucks targets organizations and Chinese-speaking individuals primarily across South and East Asia, with victims identified in Hong Kong, Thailand, Japan, Vietnam, Oman, and Sri Lanka. The campaign extends to Chinese-speaking populations in Europe. Notable targeting includes an organization operating Chinese-language online betting platforms in Sri Lanka, Hong Kong, and the Philippines—significant given China's criminal penalties for gambling operations and organizing Chinese citizens to gamble abroad. The technology sector is explicitly targeted. The actor's victim selection reflects Chinese government interests in monitoring diaspora communities, enforcing domestic policy extraterritorially, and conducting surveillance on organizations with Chinese-language operations. The abuse of widely-used Chinese applications like Sogou Input Method (developed by Tencent) enables broad reach across target demographics.

Historical Context

SlippyNunchucks has been active since at least September 15, 2023. In August 2026, Fortinet documented the group's supply chain compromise of QuickFox VPN to deliver DarkVigil. Three days after QuickFox released a clean version, the actor pivoted to exploiting Sogou Input Method, demonstrating operational agility. The current DNS hijacking campaign began July 1, 2026, and continued until Tencent patched CVE-2026-120422 in version 16.10 on October 29, 2026. While DarkVigil malware has been previously linked to Mustang Panda, ESET found no tactical overlaps in telemetry and classifies SlippyNunchucks as a distinct threat actor. The group's targeting of Chinese applications follows a pattern seen with other China-nexus actors; UNC3569 exploited a separate Sogou vulnerability (CVE-2026-51990) in September 2026 to deliver GRAYRABBIT backdoor, indicating Sogou Input Method is a high-value target for multiple Chinese APT groups.

Defensive Recommendations

  • Monitor DNS resolution anomalies for popular Chinese applications, particularly unexpected resolutions to non-vendor IP addresses; implement DNS security solutions to detect hijacking attempts
  • Enforce HTTPS-only communications for application update mechanisms and configuration retrieval; block HTTP fallback for sensitive operations
  • Detect DLL side-loading attempts involving legitimate signed binaries (e.g., Adobe executables) loading unexpected DLLs from non-standard paths; monitor for libcef.dll loaded from user-writable directories
  • Identify network traffic using Duplex Message Transport Protocol (DMTP) or unusual custom protocols for C2; baseline normal application behavior for Sogou Input Method, QuickFox, and similar tools
  • Apply vendor patches immediately for CVE-2026-120422 (Sogou Input Method 16.10+) and CVE-2026-51990; audit environments for outdated versions of Chinese-language input methods and communication tools

---

# Geopolitical Context

Geopolitical Context

The SlippyNunchucks campaign represents a sophisticated nation-state surveillance operation consistent with Chinese strategic interests in monitoring diaspora communities and sectors subject to domestic legal restrictions. The threat actor's exploitation of widely-used Chinese-language applications—including Tencent's Sogou Input Method—demonstrates a deliberate strategy to leverage trusted software ecosystems for intelligence collection across Asia and Europe. The targeting profile is notable: it encompasses Chinese-speaking populations in Hong Kong, Thailand, Japan, Vietnam, Oman, and Sri Lanka, with particular focus on organizations operating online gambling platforms in jurisdictions where such activity contravenes Chinese law. This pattern suggests dual objectives—monitoring political dissent or diaspora activity while enforcing extraterritorial compliance with domestic prohibitions. The campaign's technical sophistication, including DNS hijacking and supply chain compromise of multiple applications (QuickFox VPN, QingTalk, MiYunChat), reflects capabilities and persistence typical of well-resourced state-sponsored actors. ESET's assessment that SlippyNunchucks operates in support of Chinese government interests aligns with established patterns of PRC-nexus cyber espionage targeting linguistic and sectoral communities of strategic concern.

State Actor Alignment

SlippyNunchucks is assessed by ESET to be a China-aligned threat actor conducting nation-state surveillance operations consistent with Chinese government interests. While ESET distinguishes SlippyNunchucks from Mustang Panda—a known PRC-nexus group previously linked to the DarkVigil backdoor—the operational targeting and tradecraft suggest state sponsorship or alignment. The actor has been active since at least September 2023, demonstrating sustained operational tempo and evolving tactics. Tencent's remediation of CVE-2026-120422 in Sogou Input Method version 16.10 (released October 29, 2026) following responsible disclosure indicates private sector cooperation in addressing state-aligned threats. No public sanctions or formal government attributions have been reported in connection with this specific campaign. The targeting of gambling operations—a sector subject to strict Chinese legal prohibitions and extraterritorial enforcement efforts—is consistent with PRC priorities around transnational crime and capital flight prevention.

Business Impacty pro region

The campaign's geographic footprint spans critical regions for Chinese strategic influence and diaspora engagement. In Hong Kong, surveillance of Chinese-speaking individuals and gambling platforms may reflect Beijing's intensified security posture following the 2020 National Security Law. Targeting in Southeast Asia (Thailand, Vietnam) and South Asia (Sri Lanka, Oman) aligns with Belt and Road Initiative corridors where Chinese economic presence and intelligence collection priorities intersect. The inclusion of Japan—a U.S. treaty ally and regional counterweight to Chinese influence—suggests broader intelligence requirements beyond diaspora monitoring. European targeting (mentioned but not geographically specified) indicates global reach against Chinese-language user bases. For regional cybersecurity stakeholders, the campaign underscores risks associated with widely-deployed Chinese-origin software, particularly applications with large user bases among diaspora communities. The supply chain compromise methodology—exploiting trusted update mechanisms in legitimate applications—poses challenges for detection and creates potential for collateral impact on non-targeted users. Regional CERTs and technology sectors should assess exposure to affected applications and consider supply chain security reviews for software originating from jurisdictions with active state-sponsored cyber programs.

Forecast

If SlippyNunchucks maintains operational security and adapts to vendor patches, the threat actor is likely to continue exploiting Chinese-language applications as delivery vectors, potentially shifting to alternative software platforms as Sogou and QuickFox harden their infrastructure. The migration from HTTP to HTTPS in Sogou's October 2026 patch may prompt the actor to pursue zero-day vulnerabilities or target applications with weaker security postures. If Chinese strategic priorities around diaspora monitoring and transnational crime enforcement persist, targeting of gambling platforms and Chinese-speaking communities in Southeast and South Asia is likely to continue. Organizations in these regions using Chinese-origin software should anticipate sustained risk. If Western governments increase scrutiny of PRC-nexus supply chain threats, vendors may face pressure to implement additional security controls, potentially reducing attack surface over a 6-12 month horizon. However, the modular nature of the DarkVigil framework and the actor's demonstrated agility in shifting between applications suggest that tactical disruptions are unlikely to degrade strategic capabilities. If ESET's attribution gains broader acceptance within the threat intelligence community, SlippyNunchucks may be integrated into existing frameworks for tracking Chinese state-sponsored activity, improving collective defense posture.