Exploitation of Sogou Input Method: UNC3569 Unleashes GRAYRABBIT Backdoor
Recent security assessments have unveiled that a China-linked threat actor group, known as UNC3569, has successfully exploited a significant vulnerability in Tencent’s Sogou Input Method for Windows. This vulnerability, tracked as CVE-2026-51990, allows for a critical one-click remote code execution, enabling the deployment of a malicious backdoor named GRAYRABBIT on compromised systems.
Understanding the Vulnerability
CVE-2026-51990 encompasses several interlinked weaknesses: an insecure custom protocol handler, unrestricted navigation within an embedded browser, and the use of an outdated Chromium build lacking sandbox protections. This combination facilitated the attackers’ ability to execute arbitrary code on targeted devices.
Tencent has addressed these vulnerabilities in the latest version, 16.3.0.3498 of the Sogou Input Method, which was released through automatic updates on April 21. Organizations and users utilizing earlier versions of this software are urged to update immediately due to the risks associated with this exploit.
Sogou Input Method, a widely used Chinese-language input editor, boasts hundreds of millions of installations across various platforms. Its Windows application incorporates the sgbiz: custom URI scheme, allowing local applications and web pages to invoke internal components via biz_helper.exe. However, while this executable validates the specified executable in the module parameter, it fails to properly assess the param field before passing it as command-line input to trusted binaries within Sogou.
Mechanics of the Attack
The exploitation process initiated with a specially crafted sgbiz: URL. Attackers modified the arguments passed to the legitimate SGMyInput.exe, utilizing these parameters to access the application’s skincenter interface while directing it to an attacker-controlled URL. This interface is particularly vulnerable as, unlike other configuration pages, it initializes a Chromium Embedded Framework (CEF) webview.
The inherent vulnerability of this webview lies in its acceptance of the supplied URL without an effective origin allowlist or scheme restriction, which allows for adversarial content to load within the trusted application context. Researchers pointed out that the CEF framework utilized an obsolete version of Chromium—specifically, version 80—missing several years of crucial security updates. Furthermore, the configuration disadvantaged the application by disabling the Chromium sandbox and safety controls, amplifying the vulnerability’s risk.
As a result, browser renderer exploits gained the ability to escape normal containment boundaries, executing code with the privileges of the logged-in Windows user.
Discovery and Reporting
The vulnerabilities were flagged by researchers at Gen Threat Labs during an ongoing investigation into a UNC3569 intrusion. They discovered the vulnerabilities and promptly reported them to Tencent on April 9, 2026, highlighting the need for immediate action in addressing the weaknesses present within the Sogou Input Method.
GRAYRABBIT: The Malicious Backdoor
During the exploitation cycle, UNC3569 utilized a harmful sgbiz: link to redirect Sogou’s webview to a malicious exploit page. This page employed the well-known CVE-2021-38003 vulnerability, which affects prior versions of Chromium, allowing it to successfully leverage the outdated Chromium 80 present in Sogou.
The attack facilitated arbitrary memory read and write capabilities in V8, ultimately leading to the execution of shellcode. The attackers then downloaded three files into C:\Users\Public\Documents\: a legitimate 7z.exe binary, a harmful DLL saved as 7z.dll, and an encrypted payload blob. This technique efficiently masked the malicious activity by blending legitimate software with a harmful DLL, reducing detection likelihood.
Once launched, the 7z.exe executed DLL sideloading, with Windows loading the malicious 7z.dll from the same directory, allowing for the decryption and execution of the GRAYRABBIT backdoor.
Capabilities and Impact
GRAYRABBIT is a lightweight modular backdoor historically associated with operations from UNC3569. Its capabilities encompass remote command execution, interactive shell access, system reconnaissance, file upload and download functionality, and support for deploying additional plugins from its command-and-control infrastructure.
The observed campaign demonstrated that the backdoor was capable of connecting to an external C2 server, mail.uaiubifas[.]top, over unencrypted TCP port 443. Communications were encrypted using RC4, securing the data transmitted between compromised hosts and command servers. The system-information beacon could harvest crucial information, including the victim’s IP address, hostname, username, executable name, and process ID, before further commands were executed by the threat actors.
UNC3569 has been identified as a PRC-nexus espionage group, renowned for targeting organizations across various sectors, including government, education, technology, and finance, particularly in East and Southeast Asia. Google’s threat researchers have previously documented the group’s operations, linking them to GRAYRABBIT and highlighting their use of proprietary tools and exploitation techniques.
Recommendations for Organizations
Organizations utilizing the Sogou Input Method for Windows are strongly encouraged to update to version 16.3.0.3498 or later to mitigate these risks. The patch issued by Tencent addresses the vulnerable protocol-handler behavior, ensuring proper validation of URL arguments, restriction of navigation to secure HTTPS, and limiting allowed destinations to recognized Sogou and Tencent domains.
Security teams should remain vigilant, monitoring for suspicious sgbiz: URI activities, unexpected launches of SGMyInput.exe with harmful parameters, and unusual file creations in the local directories. Furthermore, network teams must actively investigate connections to known C2 domains and analyze any anomalous behaviors linked to 7-Zip binaries.
In summary, the unearthing of this vulnerability underscores the importance of maintaining updated software and proactive security measures to combat evolving cyber threats.