China-Linked UNC3569 Exploited Sogou Input Method Flaw to Deploy GRAYRABBIT Backdoor

The attack is notable because it weaponizes software that users normally regard as a legitimate productivity tool. Instead of relying solely on traditional phishing attachments or malicious installers, the attackers used a crafted link to abuse Sogou's custom URI protocol handler and ultimately achieve code execution in the context of the logged-in Windows user.

The vulnerability, tracked as CVE-2026-51990, was discovered by Gen while investigating an intrusion attributed to UNC3569. Tencent, which owns Sogou, was notified in April 2026 and subsequently released a fix for the vulnerable URI-handler component.

Category	Details
Threat actor	UNC3569
Attribution	China-linked / China-based hacker-for-hire activity
Target software	Sogou Input Method for Windows
Vulnerability	CVE-2026-51990
Vulnerability type	URI handler / command-line argument injection leading to RCE
Exploitation	One-click attack via crafted link
Secondary exploit	CVE-2021-38003
Malware	GRAYRABBIT
Vendor	Tencent / Sogou
Fix	Released in April 2026
Primary impact	Remote code execution in the logged-in user's context

CVE-2026-51990 itself is currently listed without a finalized CVSS score in the sources reviewed, although security researchers describe it as a critical remote-code-execution issue.

What Is Sogou Input Method?

Sogou Input Method is a Chinese-language Input Method Editor (IME) used to enter Chinese characters on Windows and other platforms.

The software has historically been extremely popular in China, making it an attractive target for attackers seeking broad access to systems where the application is installed. Sogou Pinyin has been described as one of the dominant Chinese input platforms, with hundreds of millions of users historically reported.

The security concern in this incident comes from functionality that allows Windows to process specially constructed Sogou-related URI links.

Instead of requiring a victim to download and execute a traditional malware file, an attacker can construct a malicious link that invokes the vulnerable Sogou protocol handler.

CVE-2026-51990: The Initial Entry Point

Gen Threat Labs identified CVE-2026-51990 as a remote-code-execution vulnerability in Sogou Input Method.

The flaw is associated with the application's sgbiz custom URI protocol handler.

The handler did not sufficiently validate attacker-controlled parameters before passing them to Sogou components.

This creates an opportunity for an attacker to construct a malicious URI that manipulates how Sogou processes the supplied parameters.

The attack becomes particularly dangerous because the vulnerable functionality can be reached through a crafted link, significantly reducing the interaction required from the victim.

Attack Chain: From Malicious Link to Backdoor

The observed attack can be summarized as:

Crafted link → Sogou sgbiz URI handler → malicious page loaded in Sogou CEF → vulnerable Chromium/V8 engine → code execution → GRAYRABBIT deployment

The technique effectively turns a seemingly harmless user interaction into the first stage of a multi-step exploitation chain.

Step 1: Victim Opens a Crafted Link

The operation begins with a malicious link designed to interact with the Sogou application.

When the victim clicks the link, Windows invokes the registered Sogou URI protocol handler.

The attacker therefore does not necessarily need the victim to manually download and launch an executable.

Step 2: Sogou Processes Attacker-Controlled Parameters

The vulnerable sgbiz handler processes attacker-controlled command-line arguments.

Insufficient validation allows the attacker to influence the behavior of the Sogou component and redirect its embedded browser functionality.

Step 3: Sogou Loads an Attacker-Controlled Page

The vulnerable functionality ultimately causes Sogou's embedded Chromium Embedded Framework (CEF) environment to navigate to attacker-controlled content.

This is where the attack chain becomes significantly more dangerous.

The embedded browser component was based on an outdated Chromium 80 codebase and lacked important browser security protections.

Step 4: V8 Vulnerability Is Exploited

UNC3569 then chained the Sogou vulnerability with CVE-2021-38003, a V8 vulnerability that has previously been exploited in the wild.

The older V8 vulnerability provides a path toward arbitrary code execution inside the vulnerable browser environment.

This means that the Sogou flaw effectively serves as the bridge that exposes an outdated browser engine to attacker-controlled content.

Step 5: GRAYRABBIT Is Deployed

Following successful exploitation, the attackers deploy GRAYRABBIT, a backdoor associated with UNC3569.

Google Threat Intelligence has described GRAYRABBIT as an initial-stage tool used by the group to establish access to compromised systems.

Once installed, the malware provides attackers with a foothold from which they can perform additional actions on the compromised machine.

Why the Attack Is Significant

The campaign demonstrates how legitimate desktop applications can become an initial-access mechanism for targeted intrusions.

Security teams frequently prioritize vulnerabilities in operating systems, browsers, VPN appliances and externally accessible enterprise applications. Less attention may be given to productivity utilities such as input methods.

However, software that:

• Registers custom URI protocols
• Launches processes
• Embeds browser engines
• Processes external content
• Handles attacker-controlled parameters

can provide a powerful attack surface.

In this case, several individually concerning design decisions were combined into a practical exploitation chain.

The Outdated Browser Component Is a Major Concern

One of the most important technical findings is the presence of an old Chromium-based CEF component inside the Sogou application.

Researchers found that the embedded environment lacked protections that would normally make exploitation more difficult, including Chromium's sandbox and standard web-security controls.

This creates a security problem beyond the URI-handler vulnerability itself.

Even when a vendor closes a specific entry point, an outdated embedded browser engine can continue to represent an attack surface if other paths can reach it.

This is an important lesson for software developers: patching the initial trigger does not necessarily eliminate vulnerabilities in the components that the trigger can reach.

Who Is UNC3569?

UNC3569 is a China-linked threat cluster that Google Threat Intelligence has tracked since at least 2021.

The group has been associated with China's hacker-for-hire ecosystem and has targeted organizations across government, education, technology and financial sectors, particularly in East and Southeast Asia.

Its activity demonstrates an interest in gaining an initial foothold through vulnerabilities and then deploying lightweight tooling that can provide persistent remote access.

The use of GRAYRABBIT in this campaign fits that broader operational pattern.

GRAYRABBIT Backdoor

GRAYRABBIT is a relatively small malware component associated with UNC3569.

The malware functions as an initial foothold, providing attackers with remote command capabilities after successful deployment.

This gives the threat actor a platform from which to:

• Execute commands
• Conduct reconnaissance
• Download additional payloads
• Establish persistence
• Collect information
• Move toward additional systems

The exact post-compromise objectives can vary depending on the victim and the wider operation.

Detection and Threat Hunting

Organizations that use Sogou Input Method should investigate endpoints for evidence of exploitation, particularly if the vulnerable software was installed during the period before Tencent's April 2026 fix.

Security teams should pay particular attention to unusual relationships between Sogou processes, browser components and unexpected child processes.

Recommended Hunting Areas

Telemetry	What to Look For
Process creation	Unexpected child processes originating from Sogou components
URI activity	Suspicious sgbiz protocol invocations
Browser activity	Sogou CEF connecting to unusual external domains
Network logs	Outbound connections initiated shortly after Sogou execution
File activity	Newly created executables or DLLs in user-writable locations
EDR/XDR	Suspicious process trees involving Sogou/CEF
Persistence	New scheduled tasks, registry run keys or startup items
DNS	Newly observed domains contacted immediately after link execution
Command execution	PowerShell, cmd, rundll32 or scripting activity associated with Sogou

A particularly useful detection strategy is to establish a baseline for normal Sogou behavior and alert when the application launches unexpected system utilities or creates unusual outbound connections.

Mitigation and Security Recommendations

Organizations should prioritize the following actions:

Update Sogou Input Method

The most important action is to ensure that Windows systems running Sogou Input Method have been updated to a vendor-fixed release.

Tencent/Sogou addressed the vulnerable URI-handler issue in April 2026 after Gen reported it on April 9.

Remove Unnecessary Software

If Sogou Input Method is not required for business operations, organizations should consider removing it from managed endpoints.

Reducing the number of installed applications also reduces the attack surface.

Restrict Untrusted Links

Security-awareness programs should emphasize that seemingly harmless links can invoke locally installed applications through custom URI schemes.

Email and web security controls should inspect suspicious URI-based links where technically possible.

Monitor Application-to-System Process Chains

EDR platforms should monitor applications such as input methods and embedded browsers for unusual process creation.

For example, unexpected relationships such as:

Sogou → cmd.exe → PowerShell → downloaded executable

should receive immediate investigation.

Hunt for GRAYRABBIT

Organizations with historical exposure should conduct retrospective hunting for GRAYRABBIT activity and associated UNC3569 indicators.

Endpoint telemetry, DNS logs, proxy logs and EDR data can help identify systems that may have been compromised before the software was patched.

A Broader Supply-Chain and Component-Security Lesson

This incident highlights an increasingly important security problem: vulnerabilities can exist not only in the primary functionality of an application but also in the components embedded inside it.

Sogou's input functionality was not the only relevant issue.

The attack chain also depended on an outdated browser engine and an old V8 vulnerability.

For defenders, this means software inventories should ideally capture:

Application → embedded frameworks → browser engines → libraries → third-party components

rather than treating an installed application as a single opaque package.

Final Takeaway

The UNC3569 campaign shows how a single user interaction can potentially trigger a sophisticated exploitation chain when trusted desktop software contains unsafe URI handling and outdated embedded components.

By abusing CVE-2026-51990, redirecting Sogou's embedded browser functionality and chaining the attack with CVE-2021-38003, the threat actor was able to deploy the GRAYRABBIT backdoor on targeted Windows systems.

Organizations using Sogou Input Method should ensure the application is fully updated, remove it where it is not required, and review historical endpoint telemetry for suspicious Sogou-related process and network activity.

The incident is also a reminder that security teams should not overlook niche desktop applications: a trusted utility with a custom protocol handler and an outdated embedded browser can become a direct path to endpoint compromise.