DarkVigil

Reported Context (6)

Sogou Input Method as part of a surveillance campaign designed to deploy an implant called DarkVigil (aka FDMTP). SlippyNunchucks Uses Sogou DNS Hijacking to Deliver DarkVigil
At ESET, we have been tracking the DarkVigil toolset (also known as FDMTP) and its operator, the SlippyNunchucks threat actor, since 2025. ESET Details SlippyNunchucks’ Sogou Input Method Hijack to Deploy DarkVigil
QuickFox VPN supply chain attack drops FDMTP implant Weekly Cybersecurity Roundup: Scam Abuse, Router Backdoors and Port Disruption
Upon execution, the JavaScript loader fingerprints the victim endpoint to determine if it’s a valid target before downloading and installing an FDMTP implant. QuickFox Supply-Chain Attack Deployed FDMTP Implant on Windows Systems
Mustang Panda Delivers Updated FDMTP Tool —A new campaign consistent with tradecraft associated with Mustang Panda has been observed targeting the Asia-Pacific and Japan (APJ) region to deliver an updated version of Weekly Cybersecurity Recap: Exchange and Cisco Flaws Exploited, npm Worm Spreads

CVE (7)

Malware (8)

People (6)

Threat Actors (7)

MITRE ATT&CK (33)

Vendors (13)

Products (29)

Tools (5)

Industries (5)

Countries (14)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.