A China-aligned threat actor tracked as SlippyNunchucks has been deploying the DarkVigil toolset, also known as FDMTP, through widely used Chinese applications. The recent operation abused a popular Chinese input method editor to reach organizations and Chinese-speaking individuals in Hong Kong, Thailand, Japan, Vietnam, Oman, and Sri Lanka. The actor’s activity is assessed as aligned with Chinese state interests, with notable surveillance of an online gambling organization operating across Sri Lanka, Hong Kong, and the Philippines. The exact point where DNS manipulation occurs remains unknown, so the initial access vector is unresolved. The risk is that trusted software can be used to install a modular espionage implant without user awareness.
The operation begins when a trusted input method component sends an unencrypted request for a brand-icon configuration. The actor manipulates DNS resolution in the victim environment, directing that request to an attacker-controlled staging server. The server returns a malicious configuration encrypted in a way that resembles the legitimate response. The configuration tells the component to download a legitimate signed helper binary and a malicious implant, then place them in locations used by the application’s component-management workflow. When the application later installs or loads components, it executes the disguised helper instead of the expected utility. That helper loads the implant, giving the actor execution and persistence without adding a separate persistence mechanism. Communications use a modular protocol that supports remote procedure calls, file transfer, and plugin orchestration for data collection.[/subscribe_to_unlock_form]
A China-aligned threat actor tracked as SlippyNunchucks has been deploying the DarkVigil toolset, also known as FDMTP, through widely used Chinese applications. The recent operation abused a popular Chinese input method editor to reach organizations and Chinese-speaking individuals in Hong Kong, Thailand, Japan, Vietnam, Oman, and Sri Lanka. The actor’s activity is assessed as aligned with Chinese state interests, with notable surveillance of an online gambling organization operating across Sri Lanka, Hong Kong, and the Philippines. The exact point where DNS manipulation occurs remains unknown, so the initial access vector is unresolved. The risk is that trusted software can be used to install a modular espionage implant without user awareness.
The operation begins when a trusted input method component sends an unencrypted request for a brand-icon configuration. The actor manipulates DNS resolution in the victim environment, directing that request to an attacker-controlled staging server. The server returns a malicious configuration encrypted in a way that resembles the legitimate response. The configuration tells the component to download a legitimate signed helper binary and a malicious implant, then place them in locations used by the application’s component-management workflow. When the application later installs or loads components, it executes the disguised helper instead of the expected utility. That helper loads the implant, giving the actor execution and persistence without adding a separate persistence mechanism. Communications use a modular protocol that supports remote procedure calls, file transfer, and plugin orchestration for data collection.[emaillocker id="1283"]
SlippyNunchucks is assessed as a China-aligned espionage actor whose operations center on the DarkVigil toolset. The actor has targeted organizations and Chinese-speaking individuals across South and East Asia, with occasional activity against individuals in Europe, including Germany, Russia, the United Kingdom, and Austria. The targeting of an online gambling organization operating in Sri Lanka, Hong Kong, and the Philippines is notable because it aligns with Chinese restrictions on gambling and broader pressure against fraud schemes. Defensively, organizations should treat trusted application components as potential abuse surfaces, monitor unexpected component replacement, and ensure vendor updates that enforce encrypted communications are applied.
| Tactic | Technique Id | Technique | Sub-technique |
|---|---|---|---|
| Initial Access | T1566.004 | Phishing | Spearphishing Link |
| Initial Access | T1195.002 | Supply Chain Compromise | Compromise Software Supply Chain |
| Execution | T1204.002 | User Execution | Malicious File |
| Execution | T1059.007 | Command and Scripting Interpreter | JavaScript |
| Defense Evasion | T1574.001 | Hide Artifacts | Hidden Files and Directories |
| Defense Evasion | T1027.001 | Obfuscated Files or Information | Binary Padding |
| Defense Evasion | T1055.001 | Process Injection | Dynamic Code Loading |
| Defense Evasion | T1070.004 | Indicator Removal | File Deletion |
| Discovery | T1547.001 | Software Discovery | Installed Software |
| Collection | T1560.001 | Archive Collected Data | Archive via Utility |
| Command and Control | T1071.001 | Application Layer Protocol | Web Protocols |
| Exfiltration | T1573.002 | Encrypted Storage | Encrypted Storage |
| Objective | Behavior ID | Behavior |
|---|---|---|
| Command and Control | B0030 | C2 Communication |
| Command and Control | E1105 | Ingress Tool Transfer |
| Defense Evasion | E1112 | Modify Registry |
| Process Micro-objective | C0042 | Create Mutex |
| Communication Micro-objective | C0001 | Socket Communication |
| Data Micro-objective | C0025 | Decompress Data |
| File System Micro-objective | C0052 | Writes File |
| Process Micro-objective | C0017 | Create Process |
| Operating System Micro-objective | C0036 | Registry |
The following reports contain further technical details:
[/emaillocker]