UNC3569 Exploits Sogou Input Method Flaw to Deploy GRAYRABBIT Backdoor

Threat actors linked to a China-aligned espionage group are exploiting a critical vulnerability (CVE-2026-51990) in Tencent’s Sogou Input Method for Windows to deploy the GrayRabbit backdoor. The flaw allows one-click remote code execution (RCE) and has been actively exploited in the wild by UNC3569.

What Happened: UNC3569 Exploits Sogou Input Method Flaw to Deploy GRAYRABBIT Backdoor

On September 11, 2026, researchers at Gen Digital disclosed a critical vulnerability in Sogou Input Method for Windows. The flaw is a one-click remote code execution (RCE) bug tracked as CVE-2026-51990. It allows attackers to chain three weaknesses in the product to gain full control of a victim’s machine.

Gen Threat Labs observed this vulnerability actively exploited in the wild by UNC3569, a China-aligned threat group. The group used a crafted link to trigger the exploit chain and deploy the GRAYRABBIT backdoor on victims’ computers. Sogou Input Method is one of the most widely used tools for typing Chinese characters on Windows, with over 455 million monthly users according to Citizen Lab research.

Technical Details of the CVE-2026-51990 Exploit Chain

The attack chains three weaknesses in Sogou Input Method for Windows:

The Three-Stage Attack Chain

• Stage 1 — Unvalidated Command-Line Argument Injection: An attacker crafts a malicious sgbiz: custom URI. When clicked, Windows passes it to Sogou’s biz_helper.exe protocol handler. The handler does not validate command-line arguments passed to the legitimate SGMyInput.exe executable.
• Stage 2 — Unrestricted URL Navigation: The attacker-injected arguments open Sogou’s skin store component with an attacker-controlled URL. Sogou does not restrict the URL scheme or destination.
• Stage 3 — Outdated Chromium Exploitation: A malicious page exploits CVE-2021-38003, a known vulnerability in Sogou’s outdated Chromium 80 engine. Because the browser runs without a sandbox and with web security protections disabled, the exploit achieves code execution and installs the GrayRabbit backdoor.

The exploit payload pulls three files from a staging server on Alibaba Cloud in Hong Kong: a legitimate 7-Zip binary, a malicious DLL, and an encrypted payload. The malicious DLL is saved as 7z.dll, which 7-Zip loads at startup. The DLL uses process-count anti-analysis (fewer than 50 processes causes incorrect decryption) before loading GRAYRABBIT.

Business and Operational Impact

This vulnerability poses significant risks to organizations with users who rely on Sogou Input Method, particularly in East and Southeast Asia. The impact includes:

• Compromise of Endpoints: A single malicious link can grant attackers full user-level access to a machine.
• Data Exfiltration: GRAYRABBIT supports file upload/download and system information collection.
• Lateral Movement: Reflective plugin loading enables attackers to deploy additional tools in memory.
• Government and Enterprise Targeting: UNC3569 has historically targeted government, education, technology, and finance sectors.
• Post-Compromise Persistence: The malware uses NTFS alternate data streams and marks files for deletion to evade detection.

Furthermore, Sogou’s built-in browser remains Chromium 80 with the sandbox disabled, leaving users exposed to dozens of known V8 flaws fixed in later Chrome releases.

Mitigation and Recommendations

Immediate Actions for Defenders

1. Update Sogou Input Method to version 16.3.0.3498 or later. Tencent pushed the fix via automatic update on April 21, 2026.
2. Block Indicators of Compromise (IOCs): Add the known C2 domain mail.uaiubifas[.]top (port 443) and staging server IP 8.218.50[.]207 to your blocklists.
3. Hunt for Anomalies: Look for files in C:\Users\Public\Documents\ matching the SHA-256 hashes listed below. Also monitor for non-TLS traffic on port 443 (GRAYRABBIT uses plain TCP with RC4).
4. Restrict Custom URI Handlers: Consider blocking or restricting sgbiz: links at the email gateway and endpoint level.

Long-Term Hardening

• Remove Sogou Input Method from systems where it is not strictly necessary.
• Monitor for unusual child processes spawned from Sogou-related executables.
• Enforce application allowlisting to prevent unauthorized DLL loading.

Bottom line: Organizations with users relying on Sogou Input Method should treat this as a high-priority threat. The one-click exploit chain and active in-the-wild exploitation by a state-linked group make immediate patching and IOC blocking essential.

Incident Summary

CVE ID / Incident:	CVE-2026-51990
Affected Systems:	Sogou Input Method for Windows (versions prior to 16.3.0.3498)
Disclosure Date:	September 11, 2026
Patch Status:	Patch available (version 16.3.0.3498, released April 21, 2026)
Threat Actor:	UNC3569 (China-linked espionage / hacker-for-hire)
Malware:	GRAYRABBIT backdoor
Severity:	Critical (one-click RCE, active exploitation confirmed)

References

1. Gen Digital Threat Labs, “China-Linked UNC3569 Exploited Sogou Input Method Flaw to Deploy GRAYRABBIT Backdoor,” The Hacker News, September 11, 2026, https://thehackernews.com/2026/09/china-linked-unc3569-exploited-sogou.html, accessed September 13, 2026.
2. Bill Toulas, “Hackers exploit Tencent app flaw to deploy GrayRabbit malware,” BleepingComputer, September 13, 2026, https://www.bleepingcomputer.com/news/security/hackers-exploit-tencent-app-flaw-to-deploy-grayrabbit-malware/, accessed September 13, 2026.
3. Google Threat Intelligence, UNC3569 group profile, referenced in Gen Digital research, 2024.
4. Citizen Lab, University of Toronto, Sogou Input Method research (2023), referenced in The Hacker News reporting.