UNC3569 uses Sogou Input Method flaw for GrayRabbit

Gen Threat Labs documented a live UNC3569 intrusion that started inside Tencent's Sogou Input Method for Windows. The write-up reports the chain as CVE-2026-51990 and says the group used it to drop the GrayRabbit backdoor. The write-up is Gen Digital research plus a later MITRE CVE assignment, not a CISA Known Exploited Vulnerabilities listing and not a Tencent press release.

Sogou is a Chinese input method editor with hundreds of millions of Windows installs. Gen says the critical one-click remote code execution chains three failures: unvalidated command-line argument injection in the sgbiz: protocol handler (biz_helper.exe), unrestricted URL navigation in the SGMyInput.exe skincenter CEF webview, and an outdated unsandboxed Chromium 80 engine (CEF 80.1.16, Chromium 80.0.3987.163, about March 2020).

UNC3569 is a PRC-nexus group tracked by Google Threat Intelligence. It spans cybercrime and contractor-for-hire work against government, education, technology, and finance, especially in East and Southeast Asia.

The exploit page used CVE-2021-38003, a V8 type confusion bug, against that Chromium 80 build. A 921-byte x64 downloader then pulled a legitimate 7z.exe plus a trojanized 7z.dll and wrote them under C:\Users\Public\Documents. The implant is an x64 maturation of GrayRabbit, exporting CoreClientInstall and CoreClientStart.

C2 was mail.uaiubifas[.]top on TCP 443 as raw TCP, not TLS, with RC4 and the static six-byte key m5b1u3 in 0x1000-byte frames. Staging sat at 8.218.50[.]207 on Alibaba Cloud in Hong Kong. The exploit host was noht1ng[.]top.

Gen reported the bug to Tencent on 9 April 2026. Tencent acknowledged it on 10 April and confirmed a fix, pushed as an automatic update, on 21 April 2026 as Sogou Input Method 16.3.0.3498, a 12-day turnaround.

A CVE request went in on 4 May. MITRE assigned CVE-2026-51990 on 10 July 2026. The patch validates -url and -firsturl to HTTPS and allowlisted host suffixes (sogou.com, qq.com, woa.com, sogou).

Tencent called the chain "relatively complex" and said exploitation can involve inducing the user to authorize a browser pop-up. Gen frames the path it observed as one click on a crafted sgbiz: link. The April build blocks that protocol-handler route. Gen still says the embedded browser keeps no_sandbox=1 and disable-web-security, so the CEF engine remains sandboxless and old.

Related click-and-lure tape includes Microsoft's passkey lures into Microsoft 365 cloud theft.

Some offers on this page may be paid placements or contain affiliate links.