A threat actor linked to China’s UNC3569 exploited a vulnerability in Sogou Input Method—China’s leading tool for typing characters on Windows—to install a powerful backdoor named GRAYRABBIT. This operation, uncovered by cybersecurity firm Gen Digital, hinges on a flaw in how Sogou handles custom Windows links and an outdated Chromium browser engine. The issue was patched by Tencent in April 2026, but gaps remain.
How the Attack Worked
Sogou Input Method, used by more than 455 million people globally and representing about 70% of Chinese input-method users, was the gateway for this campaign. The vulnerability resides in the Windows version, where a component called biz_helper.exe processes links with custom scheme “sgbiz:”. These links tell Sogou to launch various components without validating the arguments passed. An attacker exploited this by using an sgbiz link pointing to SGMyInput.exe (Sogou’s settings program), telling it to open the skin store with a URL controlled by the attacker.
The skin store launches a browser built into Sogou—which is based on Chromium version 80 from around March 2020. In this built-in browser, both sandbox protections and the same-origin policy are disabled. As a result, a malicious webpage using a JavaScript flaw (CVE-2021-38003) in the V8 engine, which Chrome patched back in October 2021, can escape its normal confines to run code with full user privileges. All it takes is clicking the crafted link.
What Was Delivered
After the exploit triggered, it dropped a downloader that fetched three files from a server hosted on Alibaba Cloud in Hong Kong: a genuine 7-Zip binary, a malicious DLL masquerading as a 7-Zip component, and an encrypted payload file. The DLL is then loaded in place of the legitimate one, and it checks if the system has enough running processes—underperformance triggers a corrupted key so sandboxed or fake environments (like automated malware analysis) are less effective. The loader deletes itself in a way that leaves little trace.
The final payload is the GRAYRABBIT backdoor. It communicates with its command-and-control server at mail.uaiubifas[.]top on port 443—disguised traffic using RC4 rather than TLS. The C2 domain noht1ng[.]top hosted the exploit page, while an IP from Alibaba’s Hong Kong cloud infrastructure served as the staging ground. All attacker files were placed in C:\Users\Public\Documents.
Patching and Remaining Risks
Tencent addressed the primary flaw—tracked as CVE-2026-51990—on April 9, 2026. The fix was pushed via version 16.3.0.3498, released through auto-update on April 21. The patch tightens biz_helper.exe’s argument handling and limits web addresses to HTTPS only, with whitelisted domains: sogou.com, qq.com, woa.com, and sogou.
Several risky features remain unchanged. The built-in browser engine is still stuck on Chromium 80, its sandbox disabled, and the web-security flag still off. These leave systems vulnerable to attacks that require fewer steps than previously assumed. Neither Tencent nor Gen has detailed which past versions were affected or how to check the install version reliably. It is also unknown whether installing the patch removes existing backdoors. Indicators of compromise have been published, including specific file paths, hashes for the malicious DLL and payload, and domains used for the exploit and C2 infrastructure.
What You Should Do
- Ensure Sogou Input Method is updated to version 16.3.0.3498.
- If uncertain whether your system was exposed, scan for malware artifacts: SHA-256 hashes for the loader DLL, encrypted payload, GRAYRABBIT core module; check for files under
C:\Users\Public\Documents; and monitor network traffic to suspicious domains or non-TLS use over port 443. - If you find signs of compromise, treat the system as breached; reinstalling the software may not remove an already operational backdoor.
UNC3569 has been tracked by Google Threat Intelligence since 2021. The group targets government, education, financial, and tech organizations mostly in East and Southeast Asia. GRAYRABBIT often seems to be their first foothold after intrusion—able to execute remote commands, transfer files, and load extra modules at will.
Why this matters: This compromise underscores how even widely trusted software with massive user bases can become dangerous if critical components—like link handlers and embedded browsers—are neglected. Patching UI elements isn’t enough when the browser technology behind them remains years old and insecure. Organizations using tools like Sogou Input Method must treat such dependencies with the same scrutiny as core OS or network infrastructure. Going forward, watch whether vendors commit to regularly updating under-the-hood engines like Chromium, properly enforce sandboxes and same-origin policies, and provide transparency about what versions and systems were vulnerable. Attack surfaces like these are likely under-monitored and could be leveraged again by APTs.
