UNC3569 Exploits Sogou Input Method for GRAYRABBIT Backdoor

Gen Digital researchers have identified an active campaign by the PRC-nexus threat group UNC3569 targeting users of Tencent's Sogou Input Method, a widely used Chinese-language IME with hundreds of millions of installations. The group leverages a newly assigned critical vulnerability, CVE-2026-51990, to achieve remote code execution through a single victim click. The attack exploits a chain of weaknesses: unvalidated argument injection in the 'sgbiz:' protocol handler, unrestricted URL navigation in the application's configuration tool, and the use of a six-year-old, unsandboxed Chromium browser engine.

The technical attack chain culminates in the delivery of GRAYRABBIT, a modular 64-bit C++ backdoor. The deployment process utilizes a DLL sideloading technique involving a legitimate 7-Zip binary and a trojanized loader featuring anti-sandbox checks and NTFS Alternate Data Stream (ADS) self-deletion capabilities. Once established, GRAYRABBIT facilitates full system control, including reverse shell access, file exfiltration, and the reflective loading of additional malicious plugins.

While Tencent released a patch (v16.3.0.3498) in April 2026 that mitigates the protocol handler injection, the underlying browser component remains outdated and vulnerable. This campaign underscores the significant risk posed by embedded browser engines in third-party software that are not regularly maintained or sandboxed. Organizations with a footprint in East and Southeast Asia, or those utilizing Chinese language input tools, should prioritize verifying updates and monitoring for associated network and file-based indicators.