Loading threat actor…
SlippyNunchucks is a China-aligned cyberespionage actor active since at least September 2023 whose surveillance operations align with Chinese government interests. It targets organizations and Chinese-speaking individuals primarily across South and East Asia, with additional victims in Europe and the Middle East. Identified victims include a gambling organization operating in Sri Lanka, the Philippines, and Hong Kong, an internet café in Dubai, and a university student in Denmark. SlippyNunchucks is tracked separately from Mustang Panda despite earlier attribution of its principal malware to that group. The actor deploys DarkVigil, also known as FDMTP, a modular .NET espionage toolset built on the Vigil and TouchSocket frameworks with more than 20 known plugins. DarkVigil supports remote plugin execution, persistence, data collection, and exfiltration. It uses encrypted Duplex Message Transport Protocol communications for command and control, plugin delivery, and stolen-data transfer, and can store compressed plugins in the Windows registry before loading them into .NET. SlippyNunchucks has distributed DarkVigil through a QuickFox software supply-chain compromise and by abusing insecure configuration retrieval in Sogou Input Method for Windows. Beginning in July 2026, its Sogou campaign manipulated DNS resolution to redirect unencrypted HTTP configuration requests to attacker-controlled servers. Malicious configurations instructed legitimate application components to download a signed Adobe executable and the DarkVigil implant, which was executed through DLL side-loading. Existing Sogou component-management workflows provided recurring execution without a separate persistence mechanism. The Sogou weakness was assigned CVE-2026-120422 and addressed in version 16.10 by migrating affected requests to HTTPS and enabling certificate pinning.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
10 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
3 malware families Mallory has associated with this actor across public reporting.
1 CVE Mallory has associated with this actor across public reporting. 1 of them is exploited in the wild (not necessarily by this actor).
6 indicators attributed to this actor. Values are masked here and available in full in Mallory.
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.