Hackers exploit Tencent app flaw to deploy GrayRabbit malware
UNC3569 actively exploits one-click RCE in Tencent Sogou Input Method to deploy the GrayRabbit backdoor, patched in version 16.3.0.3498.
Gen Digital reports that China-aligned UNC3569 is actively exploiting CVE-2026-51990, a one-click RCE chain in Tencent Sogou Input Method for Windows, which has hundreds of millions of installations in China. The chain abuses unvalidated command-line argument injection via the sgbiz: URI handler, unrestricted URL navigation in a CEF-based webview, and an unsandboxed outdated Chromium 80 engine to gain code execution and install the GrayRabbit backdoor. The analyzed malware is a mature 64-bit variant with RC4-encoded C2 config supporting reverse shells, file transfer, and reflective plugin loading. Tencent patched the argument validation in version 16.3.0.3498, but the browser engine remains outdated and unsandboxed.
- CVE-2026-51990 actively exploited in the wild by UNC3569
- Chain combines sgbiz: URI argument injection with unsandboxed Chromium 80 exploitation
- Deploys GrayRabbit backdoor linked to China-based contractor-for-hire ecosystem
- Patch in 16.3.0.3498 validates URLs but Chromium engine still outdated and unsandboxed
- CVEs
- CVE-2026-51990
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-51990 | One-Click Remote Code Execution in Sogou Input Method (biz_helper.exe) | 9.8 | <1% | PoC |
From the original article
2 min read at bleepingcomputer.com
Threat actors linked to a China-aligned espionage group are exploiting a critical vulnerability (CVE-2026-51990) in Tencent's Sogou Input Method for Windows to deploy the GrayRabbit backdoor. [...]
By Bill Toulas · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.