30
30
30
47
30
30
45
30
30
35
30
60
30
35
60
57
China-Linked Hackers Exploit Sogou One-Click RCE to Deploy GRAYRABBIT Backdoor
China-linked UNC3569 exploited CVE-2026-51990 in Sogou Input Method to deploy the GRAYRABBIT backdoor in active espionage intrusions.
Gen Threat Labs discovered UNC3569 exploiting CVE-2026-51990, a one-click RCE in Tencent's Sogou Input Method for Windows that chains an insecure sgbiz: protocol handler with an unsandboxed Chromium 80 CEF webview. The chain weaponizes CVE-2021-38003 (V8 type confusion) to run shellcode that DLL-sideloads via 7z.exe/7z.dll and deploys the GRAYRABBIT backdoor, which beacons over RC4-encrypted raw TCP 443 to mail.uaiubifas[.]top. Tencent patched the issue in version 16.3.0.3498, released via automatic updates on April 21, 2026. UNC3569 is a PRC-nexus espionage actor targeting government, education, technology, and financial sectors across East and Southeast Asia.
82
30
42
60
60
30
30
30
30
57
30
30
Hackers exploit Tencent app flaw to deploy GrayRabbit malware
UNC3569 actively exploits one-click RCE in Tencent Sogou Input Method to deploy the GrayRabbit backdoor, patched in version 16.3.0.3498.
Gen Digital reports that China-aligned UNC3569 is actively exploiting CVE-2026-51990, a one-click RCE chain in Tencent Sogou Input Method for Windows, which has hundreds of millions of installations in China. The chain abuses unvalidated command-line argument injection via the sgbiz: URI handler, unrestricted URL navigation in a CEF-based webview, and an unsandboxed outdated Chromium 80 engine to gain code execution and install the GrayRabbit backdoor. The analyzed malware is a mature 64-bit variant with RC4-encoded C2 config supporting reverse shells, file transfer, and reflective plugin loading. Tencent patched the argument validation in version 16.3.0.3498, but the browser engine remains outdated and unsandboxed.
80
30
30
30
30
30
30
30
42
45
30
30