China-Linked Hackers Exploit Sogou One-Click RCE to Deploy GRAYRABBIT Backdoor

China-linked threat actors tracked as UNC3569 have exploited a critical one-click remote code execution vulnerability in Tencent’s Sogou Input Method for Windows to deploy the GRAYRABBIT backdoor on targeted systems.

Tracked as CVE-2026-51990, the vulnerability chains an insecure custom protocol handler, unrestricted embedded-browser navigation, and an obsolete Chromium build running without sandbox protections.

Tencent addressed the vulnerable link-handling behavior in Sogou Input Method version 16.3.0.3498, released through automatic updates on April 21.

Organizations and users running earlier Windows versions should ensure the IME is updated immediately.

Sogou Input Method is a widely deployed Chinese-language input method editor with hundreds of millions of installations.

Its Windows application registers the sgbiz: custom URI scheme, allowing webpages and local applications to invoke internal Sogou components through biz_helper.exe.

The exploit begins with a crafted sgbiz: URL. Although biz_helper.exe validates the executable specified in the module parameter, researchers found that it did not validate the param field before passing it as command-line input to trusted Sogou binaries.

This enabled attackers to launch the legitimate SGMyInput.exe configuration program with malicious arguments.

UNC3569 used those arguments to open the application’s skincenter interface and supply an attacker-controlled URL.

Unlike other Sogou configuration pages, the skin marketplace initializes a Chromium Embedded Framework webview.

The affected code path accepted the supplied URL without applying an origin allowlist or effectively restricting the scheme, allowing adversary-controlled content to load inside the trusted application context.

The impact became critical because the bundled webview used Chromium 80, a browser version released in 2020 and missing years of security updates.

Researchers also found that Sogou’s CEF configuration disabled the Chromium sandbox and turned off web security controls.

As a result, a browser renderer exploit could escape the normal browser containment boundary and execute code with the privileges of the logged-in Windows user.

Gen Threat Labs discovered the issue, while investigating an active UNC3569 intrusion and reported it to Tencent on April 9, 2026.

GRAYRABBIT Backdoor

In the observed campaign, UNC3569 used a malicious sgbiz: link to direct Sogou’s webview to an attacker-operated exploit page.

WinMain constructs the path to SGMiniBrowserHelperHost1.0.0.8.dll, loads it via LoadLibraryExW, and resolves the GetBrowserManagerInstance export. 

The page weaponized CVE-2021-38003, a V8 type-confusion vulnerability affecting Chromium versions before 95.0.4638.69. Because Sogou shipped Chromium 80, the exploit remained viable against the embedded browser engine.

The JavaScript exploit achieved arbitrary memory read and write in V8, then used WebAssembly-backed executable memory to run embedded shellcode.

That shellcode downloaded three files into C:\Users\Public\Documents\: a legitimate 7z.exe binary, a malicious DLL saved as 7z.dll, and an encrypted payload blob.

The attackers then launched 7z.exe to trigger DLL sideloading. Windows loaded the malicious 7z.dll from the application directory, allowing the loader to decrypt and execute the final GRAYRABBIT implant.

The technique blends a legitimate signed-looking utility with a malicious same-directory DLL, reducing the need to directly execute a suspicious standalone payload.

GRAYRABBIT is a lightweight modular backdoor repeatedly associated with UNC3569.

It provides remote command execution, interactive shell access, system reconnaissance, file upload and download functionality, and support for loading additional plugins from command-and-control infrastructure.

In this campaign, the payload reportedly contacted mail.uaiubifas[.]top over raw TCP port 443 and encrypted fixed-size 4,096-byte communications with RC4.

The backdoor’s system-information beacon can collect the victim’s IP address, hostname, username, executable name, and process ID before operators issue follow-on commands.

UNC3569 has been characterized as a PRC-nexus espionage actor with a history of targeting government, education, technology, and financial-sector organizations, particularly across East and Southeast Asia.

Google threat researchers have previously linked the group’s operations to GRAYRABBIT and documented its use of proprietary tooling, public cloud infrastructure, and n-day exploitation.

Security teams should verify that Sogou Input Method for Windows is running version 16.3.0.3498 or later, the release Tencent used to remediate the vulnerable protocol-handler behavior.

The patch reportedly validates URL arguments, restricts navigation to HTTPS, and limits allowed destinations to approved Sogou and Tencent domains.

Defenders should additionally monitor for suspicious sgbiz: URI invocations, unexpected launches of SGMyInput.exe with -page=skincenter and -url= parameters, and anomalous creation of 7z.exe, 7z.dll, or encrypted files under C:\Users\Public\Documents\.

Network teams should investigate connections to mail.uaiubifas[.]top and the reported staging IP 8.218.50[.]207, while endpoint telemetry should flag DLL sideloading behavior involving 7-Zip binaries.

IOCs

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

★ Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.