Operatives connected to a China-aligned espionage outfit are leveraging a critical flaw (CVE-2026-51990) in Tencent's Sogou Input Method for Windows to distribute the GrayRabbit backdoor malware. Cybersecurity researchers at Gen Digital characterize the vulnerability as a one-click remote code execution (RCE) weakness.
We observed this vulnerability actively exploited in the wild by the UNC3569 threat group to deploy the GRAYRABBIT backdoor through a crafted link
Gen Threat Labs
Sogou Input Method is a widely-used Windows utility enabling users to input Chinese characters via standard keyboards. The application also incorporates a custom link handler and an integrated web browser running on an outdated Chromium engine. The software, created by Chinese technology conglomerate Tencent, maintains hundreds of millions of active installations throughout China.
According to Gen Threat Labs, the UNC3569 group exploits a chain of three distinct weaknesses within the application:
- unvalidated command-line argument injection through the sgbiz: URI
- unrestricted URL navigation within a CEF-based webview
- an outdated, unsandboxed Chromium browser engine
The exploitation sequence commences when a user opens a malicious sgbiz: custom URI link. This triggers Windows to launch Sogou's biz_helper.exe protocol handler, which forwards attacker-supplied command-line arguments to the legitimate SGMyInput.exe executable without performing validation checks.
The injected arguments activate Sogou's skincenter module and direct its embedded Chromium webview to retrieve an attacker-controlled webpage. Sogou fails to enforce restrictions on the URL's protocol or target location.
During the final stage, the malicious webpage triggers a documented weakness in Sogou's aging Chromium 80 installation. Since the browser operates without sandboxing and has critical web-security features turned off, the exploit gains code execution and deploys the GrayRabbit backdoor.
Google researchers identified GrayRabbit in 2024 as a modular malware platform and attributed it to UNC3569, a China-based operation active in both criminal hacking and paid cyber contractor services.
The malware variant examined by Gen Threat Labs represents a more advanced 64-bit iteration featuring an expanded set of commands and RC4-encoded command-and-control (C2) settings. The backdoor supports process launching, interactive reverse shell access, file transfer operations, system and user data harvesting, and in-memory plugin injection capabilities.
Gen Threat Labs notified Tencent of the vulnerability on April 9. The company released a corrective update through Sogou Input Method version 16.3.0.3498 on April 21.
The security patch implements validation for URL parameters passed through the protocol handler, enforces HTTPS-only connections, and limits navigation to whitelisted domains operated by Sogou and Tencent. Researchers noted, however, that the underlying browser component remains outdated and continues operating without sandbox protections, with numerous web security features remaining inactive.
Source: BleepingComputer