Sogou Traffic Hijacked to Spread Spy Toolset

A legitimate Chinese-language keyboard app became an unwitting delivery vehicle for a nation-state surveillance toolset, according to research published by ESET. By hijacking the app's brand-promotion traffic, an actor ESET calls SlippyNunchucks pushed the DarkVigil implant to users across six countries — a distribution scheme that initially looked so broad that the research team suspected a software exploit was to blame.

The findings, detailed by ESET researcher Anh Ho on November 4, trace the operation back to at least September 15, 2023, and assess with high confidence that the group works in support of surveillance objectives aligned with Chinese government interests. The campaign itself began on July 1, 2026, when Sogou Input Method users started receiving the implants.

A Keyboard's Promotion Channel Turns Hostile

Sogou Input Method, owned by Tencent, includes a component that fetches a brand-promotion configuration from a Sogou server. According to ESET, that fetch happened over unencrypted HTTP. DNS hijacking redirected those requests to servers controlled by the attackers, which answered with a malicious configuration file.

The configuration instructed the app to download the DarkVigil implant and place it in a location where Sogou's own components would execute it. That placement gave the malware persistence without needing a separate persistence mechanism — the hijacked update path did the work on its own.

ESET said it does not know where the DNS manipulation took place. The researchers listed several possibilities: routers configured with malicious DNS settings, routers implanted specifically to hijack DNS, or interception carried out at the internet service provider level.

Victims Spread Across Six Countries

The victims were located in Hong Kong, Thailand, Japan, Vietnam, Sri Lanka and Oman. ESET did not provide a victim count, but described the affected organizations and individuals: a multinational gambling organization operating from Sri Lanka, the Philippines and Hong Kong; an internet café in Dubai; and a university student in Denmark.

The breadth of the victim population — both in number and geography — is what first led ESET to suspect an exploit was in play. Instead, the common thread appears to have been the hijacked traffic path rather than a flaw in the application itself.

ESET linked the gambling-sector targeting to China's gambling restrictions and to what it described as China-aligned groups' apparent support for law enforcement action against Chinese individuals tied to regional fraud.

DarkVigil's Modular Toolset

DarkVigil, also tracked as FDMTP, is a modular .NET toolset containing more than 20 plugins. Darktrace had previously linked FDMTP to Mustang Panda with moderate confidence, but ESET said its own telemetry showed no overlap with that group and that it tracks SlippyNunchucks separately.

Before the Sogou campaign, the only publicly identified distribution method for this group was a supply-chain compromise of QuickFox, according to ESET. The Sogou hijacking represents a different approach: rather than compromising a single supply chain, the attackers inserted themselves into the network path between the app and its own update infrastructure.

Tencent's Fix and the Gaps That Remain

ESET reported the issue to Tencent on September 11, and Tencent acknowledged it on September 21. Sogou Input Method version 16.10, released in late October, moved the affected requests to HTTPS and enabled certificate pinning.

The fix closes the unencrypted request that the attackers abused. But ESET noted that the downloader component still does not validate downloaded file types or restrict where files are saved — leaving questions about how the component behaves if it is ever pointed at a hostile source again.

Where the DNS hijacking itself took place remains unknown, and that open question sits outside the scope of the client-side fix.

What the Numbers Show

• July 1, 2026 — date the campaign began, when Sogou users started receiving DarkVigil implants
• September 15, 2023 — earliest activity ESET traces to SlippyNunchucks
• Six countries — Hong Kong, Thailand, Japan, Vietnam, Sri Lanka and Oman
• More than 20 plugins — the size of the DarkVigil (.NET) toolset
• September 11 and September 21 — dates ESET reported the issue to Tencent and Tencent acknowledged it
• Version 16.10 — Sogou Input Method release that added HTTPS and certificate pinning

The Attribution Question

ESET's assessment — high confidence that SlippyNunchucks is associated with a nation-state surveillance effort aligned with Chinese government interests — is the strongest attribution claim in the research. The group's targeting choices, including the gambling-sector focus, are cited by ESET as consistent with that assessment.

The researchers were careful to separate their tracking from prior work: Darktrace's moderate-confidence link between FDMTP and Mustang Panda does not match ESET's telemetry, and ESET tracks the activity under its own name. That divergence matters for defenders comparing notes across vendors, since the same toolset appears under different group labels depending on the source.

How the Hijack Likely Worked

The mechanics described by ESET are a reminder that update and configuration channels are only as trustworthy as the path they travel. Sogou's component requested its brand-promotion configuration over plain HTTP, which means anyone positioned between the app and the Sogou server could read and alter the response.

The attackers used DNS hijacking to become that intermediary. By redirecting the request to their own servers, they returned a configuration that pointed the app at the DarkVigil implant. The app then downloaded and stored the implant in a location its own components would execute, according to ESET.

ESET's list of possible interception points — malicious DNS settings on routers, implanted routers, or ISP-level interception — covers a range of scenarios from local network compromise to broader infrastructure manipulation. The researchers did not determine which applied in this campaign.

What Defenders Should Take From It

The Sogou case illustrates how a trusted application's own plumbing can be repurposed. The app was not modified; its traffic was. For organizations, the practical question is whether any software on their networks fetches configuration or updates over unencrypted channels, and whether those channels can be redirected by anyone who controls DNS resolution.

ESET's disclosure timeline — report on September 11, acknowledgment on September 21, fix in late October — shows a roughly six-week path from notification to a patched release, though the downloader's remaining validation gaps mean the component is not fully hardened even after version 16.10.

For users of Sogou Input Method, the fix is available in version 16.10. For everyone else, the campaign is a case study in why DNS integrity matters as much as application security: the app did exactly what it was told, and the instructions were forged in transit.

Why It Matters

The Sogou campaign suggests that supply-chain style attacks do not always require compromising a vendor's build system. Inserting a malicious response into an unencrypted configuration fetch achieved the same outcome — malware running under the guise of a legitimate app's own components — without touching Sogou's code. That lowers the bar for actors who can manipulate DNS somewhere along the path, whether at a router, an ISP, or another chokepoint.

For businesses, the episode is a reminder that endpoint security tools and app-store vetting may not catch malware delivered through an application's own update channel. Network-level DNS controls and monitoring for unexpected resolution changes could matter as much as patching. For individual users, particularly those on networks where router or ISP settings are outside their control, the incident underscores that even trusted apps can be turned into delivery vehicles when their traffic is unencrypted — and that the location of the hijack, in this case, is still unknown.