Loading malware…
DarkVigil, also known as FDMTP, is a modular Windows backdoor and .NET espionage toolset comprising an implant and more than 20 known plugins. Built on the Vigil malware framework and TouchSocket networking framework, it uses Duplex Message Transport Protocol (DMTP) for encrypted command-and-control communications, remote procedure calls, plugin orchestration, and data exfiltration. The implant sends victim-profile information to its controller and receives compressed plugins that it stores in the Windows registry before decompressing and loading them into .NET. Plugins support persistence and data collection, communicating with the controller through the implant as a relay.
DarkVigil is deployed by the China-aligned cyberespionage actor SlippyNunchucks against organizations and Chinese-speaking individuals, particularly in South and East Asia. Documented targets include gambling-related organizations and individuals connected to regional fraud schemes. Delivery operations have included a QuickFox software supply-chain compromise and abuse of insecure HTTP configuration requests in Sogou Input Method.
In the Sogou operation observed from July 2026, DNS hijacking redirected application requests to attacker-controlled servers. Malicious configurations caused the legitimate application to download a signed Adobe executable alongside the DarkVigil implant, which was executed through DLL side-loading. The operation reused existing Sogou component-management workflows for recurring execution rather than installing a separate persistence mechanism. Observed victims were located in Hong Kong, Thailand, Japan, Vietnam, Oman, and Sri Lanka.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
2 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
DarkVigil is a modular .NET toolset that includes the DarkVigil implant and more than 20 known plugins.
DarkVigil, also known as FDMTP, is a modular .NET toolset with more than 20 plugins.
10 distinct techniques documented for this family, organized by ATT&CK tactic.
SlippyNunchucks cible des individus sinophones au Sri Lanka via le détournement des mises à jour de QuickFox pour déployer le toolset DarkVigil (aka FDMTP) ; DeceptiveDevelopment remonte la chaîne d’approvisionnement logicielle : vol de credentials Git/SSH, injection de code malveillant dans des dépôts publics/privés
SlippyNunchucks injected a malicious configuration into Sogou Input Method’s network communication via DNS hijacking.
The disguised biz_helper.exe then side-loads the malicious \Components\libcef.dll, resulting in execution of the DarkVigil implant.
The server invokes the RegistryPlugin method, which stores the plugin’s compressed binary in the registry key HKCU\Software\Microsoft\IME\<HWID>\pluginHash.
The malicious configuration instructs SGTool.exe to save the legitimate Adobe binary (biz_helper.exe) as \Components\SogouComMgr.exe.
The disguised biz_helper.exe then side-loads the malicious \Components\libcef.dll, resulting in execution of the DarkVigil implant.
The server invokes the RegistryPlugin method, which stores the plugin’s compressed binary in the registry key HKCU\Software\Microsoft\IME\<HWID>\pluginHash.
In the victims’ environments, the DNS resolution of config.pinyin.sogou[.]com was controlled by the attacker who resolved it to one of their staging servers.
In the victims’ environments, the DNS resolution of config.pinyin.sogou[.]com was controlled by the attacker who resolved it to one of their staging servers.
DarkVigil uses HTTP to connect to its bootstrap server.
The malicious configuration instructs a Sogou Input Method component to download DarkVigil. DarkVigil can download additional plugins from the C&C server.
DarkVigil uses encrypted messages to communicate with its C&C server.
SlippyNunchucks injected a malicious configuration into Sogou Input Method’s network communication via DNS hijacking.
DarkVigil can use DMTP to exfiltrate data to its C&C server.
5 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.