China-Linked UNC3569 Exploited Sogou Input Method Flaw to Deploy GRAYRABBIT Backdoor

A China-linked hacking group exploited a flaw in Sogou Input Method, one of the most widely used tools for typing Chinese characters on Windows, to install a backdoor on victims' computers, security company Gen Digital said in research published Thursday.

The attack started with a crafted link and ended with the attacker able to do anything the logged-in user could do. Tencent, which owns and develops Sogou, fixed the flaw in April 2026.

Gen found the flaw while investigating a live intrusion by UNC3569, a group that Google Threat Intelligence ties to China and places in the country's hacker-for-hire scene. Google has tracked the group since 2021 and says it has targeted government, education, technology, and finance sectors, mostly in East and Southeast Asia.

The backdoor it installed is GRAYRABBIT, a small program the group has used for years and that Google describes as its first step onto a machine. It gives an attacker a remote command shell, allows files to be moved in both directions, and can load additional modules from the attacker's server at any time.

Tencent's fix blocked the way in. It did not change the part of Sogou that made the attack possible. In the patched version Gen examined, the built-in browser engine is still the 2020 version, and its sandbox is still switched off.

How One Link Reached the Machine

Sogou Input Method is the most popular Chinese input method in China, according to 2023 research by Citizen Lab at the University of Toronto.

That research put its user base at more than 455 million people a month across Windows, Android and iOS, and its share of Chinese input-method users at about 70%. Citing market research on visits to the product's website, it also noted that users are not only in China, with the United States accounting for over 3.3% of visits.

The same research found flaws in the app's encryption that exposed what people typed.

The flaw Gen found is in the Windows version. Sogou Input Method is not one program there. It is a set of components that communicate with each other via a custom link type registered on Windows, sgbiz:. When anything opens an sgbiz: link, Windows passes it to biz_helper.exe, which reads the link and starts the Sogou component it names.

That handler checks which program the link asks it to start. It does not check the command-line arguments the link asks it to pass along. Gen found no filtering on them at all.

So the attacker picked the arguments. The link pointed at SGMyInput.exe, Sogou's settings program, and told it to open the skin store with a web address of the attacker's choosing.

The skin store is the only screen in that program that opens a browser window. The code sends that browser to whatever address it is handed, with no check on the address at all.

That browser is where the third problem sits. Sogou builds its own copy of Chromium, and it's version 80, from around March 2020.

Gen found two of the browser's protections switched off and written into the code that way: the sandbox, which normally keeps a compromised web page away from the rest of the computer, and the same-origin policy, which stops a page reading data from other sites.

With the sandbox gone, a JavaScript flaw in the page becomes code that runs on the user's computer with the user's privileges. There is no second step to exit the browser.

Gen says clicking the link was all it took. Tencent does not agree. In a response quoted in the research, Tencent described the chain as relatively complex and said an attacker would need social engineering to get the user to "actively authorize the browser's pop-up prompt."

Browsers built on Chromium do show a confirmation box before handing a link to a separate program on the computer, and a user can tick a box to stop seeing it for a given site. Neither company says what the people in this campaign saw. Gen says the link could also arrive by email or chat message, and neither account says what a user sees when a link is opened that way.

Why a 2021 Browser Bug Still Worked

The page the victims were sent to carried an exploit for CVE-2021-38003, a flaw in how V8, Chrome's JavaScript engine, handled JSON.stringify. It let an internal value that scripts should never see escape into the page, and from there an attacker could corrupt memory and run code.

Google fixed it in Chrome 95 in October 2021. CISA added it to its catalog of vulnerabilities known to have been exploited on November 3, 2021. Singapore firm STAR Labs published a full analysis and working exploit code in December 2022.

Sogou's Chromium build never received that fix. It never got most of the others either.

Of the 41 Chromium V8 flaws in CISA's catalog, at least 32 were fixed in Chrome releases that came out after the version Sogou ships. The Hacker News checked each flaw's CVE record against that version.

That is a count of flaws, not a count of ways into Sogou. Whether any of them can be reached through the skin store window depends on what the page can touch inside it, and no one has published that work.

What Landed on the Machine

The exploit carried a small downloader. Gen traced it pulling three files from a server on Alibaba Cloud in Hong Kong: a legitimate copy of 7-Zip, a malicious DLL, and an encrypted file holding the final payload.

All three went into C:\Users\Public\Documents. The malicious DLL was saved under the name 7-Zip loads from its own folder at startup, so running 7-Zip loaded the attacker's code instead.

The archive command the attackers ran was meaningless. Its only job was to start 7-Zip.

The DLL counts the processes running on the computer before it decrypts anything. If it finds fewer than 50, it builds the wrong key and the payload turns to garbage.

Automated malware-analysis systems tend to run few processes. Real desktops do not.

It then deletes itself. Gen found it moving its own contents into an NTFS alternate data stream, a hidden part of the file record, and then marking the file for deletion. The file leaves the disk with no delete call in the behavior logs.

What it leaves behind is GRAYRABBIT. The backdoor reaches its server at mail.uaiubifas[.]top on port 443, and the traffic there is plain TCP scrambled with RC4 rather than TLS. Port 443 typically carries TLS, so non-TLS traffic on that port is worth watching.

What Tencent Fixed, and What It Left

Gen reported the flaw to Tencent on April 9, 2026, and it is tracked as CVE-2026-51990.

Tencent replied the next day and confirmed on April 21 that a fix was complete and would go out to all users via an automatic update in version 16.3.0.3498. That is 12 days.

The whole fix sits in biz_helper.exe. It now looks for the two arguments that carry web addresses, rejects anything that is not HTTPS, and checks the hostname against four allowed endings: sogou.com, qq.com, woa.com and sogou. Gen says more checks were added after that.

The browser engine was not touched. In the patched files Gen examined, the sandbox setting is still off, the web security flag is still written into the code, and the same switches are still applied.

The engine is still Chromium 80. What has changed is that an outsider can no longer point it at an address of their choosing via the link handler. Gen said those components need more work.

What to Do

Update Sogou Input Method. The fix is in version 16.3.0.3498, which Gen says Tencent pushed to all users by automatic update on April 21, 2026.

Two things are missing from the public record. Neither Gen nor Tencent has said which versions were affected, and neither explains how to check the version installed on a machine.

If a machine may have been reached before the fix, look for the indicators below. The loader deletes itself, so the malicious DLL may no longer be on disk. No source says whether installing the fix removes a backdoor that is already running.

Gen published the following indicators.

• SHA-256 29c7ee41d0cc9e07d981e451df56d0c3d37c41ac4ec10c7b516cc033ee397a63 malicious DLL loader, written to disk as 7z.dll
• SHA-256 749160a2f20f82744026719cf72e483595c6aad718efa74d675a98662e02422e encrypted payload file, named p
• SHA-256 d7a3c7eb94edc0e020f74c678743d71d61e944634aade4a67a96c3589e828b3a GRAYRABBIT backdoor, internal name core.dll
• Domain mail.uaiubifas[.]top backdoor command server, port 443
• Domain noht1ng[.]top hosted the exploit page
• IP 8.218.50[.]207 staging server, Alibaba Cloud Hong Kong
• Path C:\Users\Public\Documents\ where the three files were written

Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.