A China-linked threat actor tracked as UNC3569 exploited a vulnerability in Sogou Input Method, one of China’s most widely used tools for typing Chinese characters, to compromise Windows systems and deploy the GRAYRABBIT backdoor. The vulnerability, tracked as CVE-2026-51990, was discovered by Gen Digital while investigating an active intrusion.
The attack could begin with a specially craftedsgbiz:link. Sogou registers this custom URL protocol in Windows and passes requests tobiz_helper.exe, but researchers found that while the program checked which Sogou component could be launched, it failed to properly validate the command-line arguments supplied to that component.
Attackers exploited this behavior to launchSGMyInput.exe, Sogou’s settings application, and direct its built-in skin-store browser to an attacker-controlled website. The embedded browser presented an especially dangerous attack surface because it was based on Chromium 80 from 2020, with both its sandbox and same-origin protections disabled.
The malicious page then exploited CVE-2021-38003, an old V8 JavaScript engine vulnerability that Google patched in Chrome 95 in 2021. Because Sogou continued using the outdated Chromium engine, the years-old vulnerability remained exploitable, and disabling the browser sandbox meant attackers did not need an additional sandbox escape to execute code with the victim’s privileges.
Gen Digital linked the campaign to UNC3569, a group associated with China’s hacker-for-hire ecosystem. The threat actor has been tracked since 2021 and has targeted government, education, technology and financial organizations, primarily across East and Southeast Asia.
After exploitation, the attackers downloaded three files from infrastructure hosted on Alibaba Cloud in Hong Kong: a legitimate copy of 7-Zip, a malicious DLL and an encrypted payload. The files were placed insideC:\Users\Public\Documents, with the malicious DLL positioned so that 7-Zip would automatically load it when executed.
The loader also contained anti-analysis functionality. It counted running processes before decrypting the payload, deliberately generating an incorrect decryption key when fewer than 50 processes were detected. Because automated malware sandboxes often run significantly fewer processes than real desktop systems, the technique could prevent the final malware from executing during automated analysis.
The final payload was GRAYRABBIT, a backdoor previously associated with UNC3569. It provides attackers with a remote command shell, supports file uploads and downloads, and can retrieve additional modules from command-and-control infrastructure.
GRAYRABBIT communicated withmail.uaiubifas[.]topover port 443, but instead of normal HTTPS traffic, it used plain TCP communications obfuscated with RC4. Network defenders may therefore be able to detect infections by looking for non-TLS traffic unexpectedly using a port normally associated with HTTPS.
Gen Digital reported the vulnerability to Tencent on April 9, 2026. Tencent completed a fix within 12 days and distributed version 16.3.0.3498 through automatic updates. The patch restricts URLs passed through the vulnerable mechanism to HTTPS and validates hostnames against an approved list.
However, researchers noted that the underlying browser architecture remains concerning. The patched version they examined still uses Chromium 80 with the sandbox and other web-security protections disabled. The immediate attack vector has been closed, but the outdated embedded browser itself was not replaced.
This is particularly significant because numerous Chromium vulnerabilities have been discovered since version 80. Of the 41 V8 vulnerabilities currently included in CISA’s Known Exploited Vulnerabilities catalog, at least 32 were fixed in Chrome releases newer than the Chromium version bundled with Sogou.
Users should ensure that Sogou Input Method has been updated to version 16.3.0.3498 or later. Systems that may have been exposed before the April update should also be investigated for indicators associated with GRAYRABBIT, as installing the patch prevents the original entry method but does not necessarily remove a backdoor already installed on the machine.
The campaign demonstrates a broader security problem with applications that embed outdated browser engines. A vulnerability patched by Google nearly five years earlier remained useful to attackers because another widely deployed application continued shipping an obsolete Chromium build with critical protections disabled, effectively turning an old exploit into a viable modern attack technique.