China-aligned group abuses Sogou Input Method to deliver malware
ESET researcher names SlippyNunchucks group and details DNS hijacking in Sogou app leading to DarkVigil malware delivery.
60
Victim
university student in Denmark
- Mentions · 7d0
- Mentions · 30d2
- All mentions2
- First seenNov 4, 2026
- Last mentioned7d ago
Timeline
2 articles · newest firstSlippyNunchucks hijacks Sogou Input Method to deploy DarkVigil malware
The SlippyNunchucks threat actor hijacked the Sogou Input Method branded vocabulary promotion mechanism to deploy DarkVigil implants targeting Chinese-speaking users in Asia and Europe.
75
Related CVEs
by mentions- HTTP config retrieval in Sogou Input Method for Windows
Appears with
- Sogou Input Methodproduct · 2
- SlippyNunchucksthreat actor · 2
- Tencentvendor · 2
- DarkVigilmalware · 2
- multinational gambling organizationvictim · 2
- internet cafe in Dubaivictim · 1
- Internet café in Dubaivictim · 1
- Tencent Security Response Centerorganization · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.