China-Linked UNC3569 Exploited Sogou Input Method Flaw to Deploy GRAYRABBIT Backdoor
China-linked UNC3569 exploited a Sogou Input Method flaw to deploy GRAYRABBIT backdoor on Windows machines across East and Southeast Asia.
Gen Digital found that China-linked UNC3569, a hacker-for-hire group tracked by Google since 2021, exploited a flaw in Sogou Input Method's Windows sgbiz: link handler to reach a sandbox-disabled Chromium 80 build and exploit 2021's CVE-2021-38003 for code execution. The chain delivered GRAYRABBIT, a remote shell backdoor capable of file transfer and module loading, via a 7-Zip DLL sideloading trick gated on process count. Tencent fixed the handler flaw in April 2026 but the embedded browser remains outdated. Sogou has over 455 million monthly users and roughly 70% share of Chinese input methods.
- UNC3569 linked to China's hacker-for-hire scene, active since 2021
- GRAYRABBIT backdoor provides remote shell, file transfer, module loading
- Sogou Chromium 80 build lacked sandbox and 2021 V8 fixes
- DLL sideload via 7-Zip; decrypts only when 50+ processes running
- Tencent patched handler flaw in April 2026; browser remains unpatched
- CVEs
- CVE-2021-38003
- ATT&CK
- T1203 Exploitation for Client ExecutionT1204.002 User Execution: Malicious FileT1574.002 Hijack Execution Flow: DLL Side-LoadingT1059 Command and Scripting InterpreterT1105 Ingress Tool Transfer
- Vendors
- TencentGen DigitalGoogleCISA
- Products
- Sogou Input Method7-Zip
- Threat actors
- UNC3569
- Malware
- GRAYRABBIT
- Organizations
- Citizen LabSTAR Labs
- Countries
- China
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2021-38003 | Memory Corruption in Chromium V8 JSON.stringify Affects Chrome, Edge, Opera | 8.8 | 39% | KEVPoC | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | noht1ng.top | il.uaiubifas[.]top backdoor command server, port 443 Domain noht1ng[.]top hosted the exploit page IP 8.218.50[.]207 staging server, |
| domain | uaiubifas.top | hind is GRAYRABBIT. The backdoor reaches its server at mail.uaiubifas[.]top on port 443, and the traffic there is plain TCP scrambled |
| ipv4 | 8.218.50.207 | r, port 443 Domain noht1ng[.]top hosted the exploit page IP 8.218.50[.]207 staging server, Alibaba Cloud Hong Kong Path C:\Users\Pub |
| sha256 | 29c7ee41d0cc9e07d981e451df56d0c3d37c41ac4ec10c7b516cc033ee397a63 | dy running. Gen published the following indicators. SHA-256 29c7ee41d0cc9e07d981e451df56d0c3d37c41ac4ec10c7b516cc033ee397a63 malicious DLL loader, written to disk as 7z.dll SHA-256 749 |
| sha256 | 749160a2f20f82744026719cf72e483595c6aad718efa74d675a98662e02422e | a63 malicious DLL loader, written to disk as 7z.dll SHA-256 749160a2f20f82744026719cf72e483595c6aad718efa74d675a98662e02422e encrypted payload file, named p SHA-256 d7a3c7eb94edc0e020f |
| sha256 | d7a3c7eb94edc0e020f74c678743d71d61e944634aade4a67a96c3589e828b3a | 74d675a98662e02422e encrypted payload file, named p SHA-256 d7a3c7eb94edc0e020f74c678743d71d61e944634aade4a67a96c3589e828b3a GRAYRABBIT backdoor, internal name core.dll Domain mail.uai |
From the original article
6 min read at thehackernews.com
A China-linked hacking group exploited a flaw in Sogou Input Method, one of the most widely used tools for typing Chinese characters on Windows, to install a backdoor on victims' computers, security company Gen Digital said in research published Thursday. The attack started with a crafted link and ended with the attacker able to do anything the logged-in user could do. Tencent, which owns
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.