SlippyNunchucks

Summary

China-aligned threat actor named by ESET. In May 2026 it targeted Chinese-speaking individuals in Sri Lanka — a growing base for online-fraud networks — by hijacking updates of the legitimate QuickFox software to deploy its DarkVigil toolset, also known as FDMTP (T1195.002). ESET says update hijacking is this actor's typical method. ESET assesses the operation may have supported law-enforcement action against the Southeast Asian scam industry, as Chinese and Sri Lankan police cooperation has grown. Fortinet separately reported trojanised QuickFox installers delivering FDMTP from mid-2025 and noted overlaps with Mustang Panda, without attributing it; neither vendor ties that activity to this name, so it is not on this record. Only ESET reports SlippyNunchucks publicly so far.

Attribution

ESET: China-aligned; single public report, no government attribution

Assessed by security researchers or MITRE ATT&CK; no government attribution on record.

• ESET Research (Research, 2026-10-28)
  China-aligned threat actor named by ESET

Campaigns 1

Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.

MITRE ATT&CK techniques 1

Malware and tools 1

Reporting and advisories 2

• ESET Research
  ESET APT Activity Report Q2–Q3 2026 (Oct 2026)
• ESET Research
  ESET APT Activity Report Q2 2026–Q3 2026 — summary (Oct 2026)