China-Linked Hackers Exploit Sogou One-Click RCE to Deploy GRAYRABBIT Backdoor
China-linked UNC3569 exploited CVE-2026-51990 in Sogou Input Method to deploy the GRAYRABBIT backdoor in active espionage intrusions.
Gen Threat Labs discovered UNC3569 exploiting CVE-2026-51990, a one-click RCE in Tencent's Sogou Input Method for Windows that chains an insecure sgbiz: protocol handler with an unsandboxed Chromium 80 CEF webview. The chain weaponizes CVE-2021-38003 (V8 type confusion) to run shellcode that DLL-sideloads via 7z.exe/7z.dll and deploys the GRAYRABBIT backdoor, which beacons over RC4-encrypted raw TCP 443 to mail.uaiubifas[.]top. Tencent patched the issue in version 16.3.0.3498, released via automatic updates on April 21, 2026. UNC3569 is a PRC-nexus espionage actor targeting government, education, technology, and financial sectors across East and Southeast Asia.
- CVE-2026-51990 chains sgbiz: protocol handler with sandbox-disabled Chromium 80 webview.
- Exploit reuses CVE-2021-38003 V8 type confusion against the embedded browser engine.
- GRAYRABBIT delivered via DLL sideloading using 7z.exe and malicious 7z.dll.
- Backdoor C2: mail.uaiubifas[.]top over raw TCP 443 with RC4 encryption.
- Patch in Sogou Input Method 16.3.0.3498; verify all installations are updated.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2021-38003 | Memory Corruption in Chromium V8 JSON.stringify Affects Chrome, Edge, Opera | 8.8 | 39% | KEVPoC | KEV |
| CVE-2026-51990 | One-Click Remote Code Execution in Sogou Input Method (biz_helper.exe) | 9.8 | <1% | PoC |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | noht1ng.top | ryption RC4-encrypted communications Exploit-hosting domain noht1ng[.]top Staging-server IP address 8.218.50[.]207 Staging-server p |
| domain | uaiubifas.top | re. In this campaign, the payload reportedly contacted mail.uaiubifas[.]top over raw TCP port 443 and encrypted fixed-size 4,096-byte |
| ipv4 | 8.218.50.207 | ections to mail.uaiubifas[.]top and the reported staging IP 8.218.50[.]207 , while endpoint telemetry should flag DLL sideloading be |
| sha256 | 29c7ee41d0cc9e07d981e451df56d0c3d37c41ac4ec10c7b516cc033ee397a63 | involving 7-Zip binaries. IOCs Indicator Value SHA-256 hash 29c7ee41d0cc9e07d981e451df56d0c3d37c41ac4ec10c7b516cc033ee397a63 Associated file 7zp.dll File description Trojanized DLL loa |
| sha256 | 749160a2f20f82744026719cf72e483595c6aad718efa74d675a98662e02422e | on Trojanized DLL loader Internal name boy.dll SHA-256 hash 749160a2f20f82744026719cf72e483595c6aad718efa74d675a98662e02422e Associated file p File description Encrypted PE loader shel |
| sha256 | d7a3c7eb94edc0e020f74c678743d71d61e944634aade4a67a96c3589e828b3a | File description Encrypted PE loader shellcode SHA-256 hash d7a3c7eb94edc0e020f74c678743d71d61e944634aade4a67a96c3589e828b3a Associated malware GRAYRABBIT backdoor Internal name core.d |
From the original article
4 min read at gbhackers.com
China-linked threat actors tracked as UNC3569 have exploited a critical one-click remote code execution vulnerability in Tencent’s Sogou Input Method for Windows to deploy the GRAYRABBIT backdoor on targeted systems. Tracked as CVE-2026-51990, the vulnerability chains an insecure custom protocol handler, unrestricted embedded-browser navigation, and an obsolete Chromium build running without sandbox protections.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.