UNC3569 Exploited Sogou Input Method to Install GRAYRABBIT Backdoor

A China-linked threat group tracked as UNC3569 exploited the Windows version of Sogou Input Method to execute code and deploy the GRAYRABBIT backdoor, according to research published by Gen Digital.

The intrusion began with a crafted link sent through email or chat. Once opened, the link abused Sogou’s custom Windows protocol to load an attacker-controlled page inside an obsolete Chromium-based browser embedded in the application.

Tencent, which owns and develops Sogou, closed the identified navigation path with an automatic update to version 16.3.0.3498. However, the patched application still contains Chromium 80 with its sandbox disabled and web security controls removed.

A custom Sogou protocol exposed attacker-controlled arguments

Sogou Input Method for Windows uses several processes that communicate through the custom sgbiz: URL scheme. Windows passes links using that scheme to biz_helper.exe, which determines which Sogou component should run.

The handler checked whether the requested component was legitimate but failed to validate the command-line arguments passed to it. An attacker could therefore select a trusted Sogou executable while controlling parameters that influenced its behavior.

The observed link launched SGMyInput.exe, the application’s settings component, and directed its skin-store screen to an external address. This screen was significant because it was the only part of the settings interface that opened a browser window.

Sogou accepted the supplied destination without confirming that it belonged to an approved domain. The attacker could consequently render an exploit page inside Sogou’s embedded browser rather than in a fully updated system browser.

Gen tracks this link-handling vulnerability as CVE-2026-51990. The complete list of affected Sogou versions has not been disclosed, and neither Gen nor Tencent has documented a procedure for checking the locally installed version.

Gen reported the vulnerability to Tencent on April 9, 2026. The company responded the following day and confirmed on April 21, 2026 that remediation was complete.

Chromium 80 turned a crafted page into host code execution

The exploit page contained JavaScript targeting CVE-2021-38003, an older vulnerability in Chromium’s V8 JavaScript engine. Improper handling in V8 can produce heap corruption when a victim opens a specially crafted HTML page.

The flaw affects Google Chrome versions before 95.0.4638.69. It carries a CVSS 3.1 score of 8.8, with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.

That vector describes network-accessible exploitation with low complexity, no prior privileges and required user interaction. A successful attack can have high confidentiality, integrity and availability impacts.

Google fixed the vulnerability in Chrome 95.0.4638.69, with the correction released in October 2021. Sogou’s embedded browser was based on Chromium 80 and had not incorporated that fix.

Two configuration choices made the exposure more severe. The browser sandbox was disabled, removing the isolation layer normally placed between rendered web content and the host. Sogou had also disabled the same-origin policy, allowing pages to cross boundaries that usually separate data belonging to different origins.

Once the V8 exploit succeeded, the malicious page could execute code with the logged-in user’s privileges. No separate sandbox escape was required.

Gen said clicking the crafted link was sufficient in the intrusion it analyzed. Tencent described the chain as more complex and said social engineering would be needed to persuade the user to authorize a browser pop-up.

Chromium-based browsers may ask for confirmation before handing a custom protocol to a local application. Neither company documented the exact prompt shown to victims or explained whether email and chat clients produced different behavior.

GRAYRABBIT arrived through DLL side-loading

After gaining code execution, the exploit launched a small downloader that retrieved three files from infrastructure hosted on Alibaba Cloud in Hong Kong:

• A legitimate 7-Zip executable.
• A malicious DLL named 7z.dll.
• An encrypted file named p containing the final payload.

The downloader placed all three in:

C:\Users\Public\Documents\

The attack then used DLL side-loading. When the legitimate 7-Zip binary started, it searched its local directory and loaded the attacker’s 7z.dll. The archive-related command-line parameters were effectively decoys; launching the trusted executable was enough to trigger malicious code.

The loader also attempted to identify automated analysis systems. It counted running processes before decrypting the payload. If it found fewer than 50, it deliberately derived the wrong key, leaving the encrypted malware unusable. Normal desktops commonly exceed that threshold, while streamlined sandboxes may not.

To hide its departure, the loader moved its contents into an NTFS alternate data stream and marked the original file for deletion. Investigators may therefore find that 7z.dll has vanished without seeing a conventional deletion event in behavioral logs.

The decrypted payload was GRAYRABBIT, a backdoor associated with UNC3569. It provides an interactive command shell, bidirectional file transfer and dynamic retrieval of additional modules.

GRAYRABBIT contacted mail.uaiubifas[.]top on TCP port 443. The connection did not use TLS; instead, the malware exchanged RC4-obfuscated plain TCP traffic. Non-TLS sessions on a port normally associated with HTTPS offer a useful network-detection signal.

Attribution points to a China-linked hire-for-hack group

Google Threat Intelligence has tracked UNC3569 since 2021 and places it within China’s hacker-for-hire ecosystem. The group has reportedly targeted government, education, technology and financial organizations, primarily in East and Southeast Asia.

The attribution of this campaign to UNC3569, including its connection to China, comes from Gen’s reporting and Google Threat Intelligence’s assessment. It is not established by the technical CVE records.

Sogou’s scale increases the potential exposure. Citizen Lab research published in 2023 estimated more than 455 million monthly users across Windows, Android and iOS, accounting for about 70% of Chinese input-method users. The research also found an international footprint, with the United States generating more than 3.3% of visits to Sogou’s website.

Those figures cover several operating systems and do not indicate how many installations ran a vulnerable Windows release. Exact exposure remains unknown.

The patch blocks the route but leaves the old browser intact

Tencent concentrated its correction in biz_helper.exe. The updated handler identifies the two arguments capable of carrying web addresses, requires HTTPS and restricts destinations to hostnames ending in:

• sogou.com
• qq.com
• woa.com
• sogou

Additional validation was also added. These controls prevent an external attacker from using the observed sgbiz: technique to send the skin-store browser directly to an arbitrary malicious domain.

The broader browser risk remains. Gen found that version 16.3.0.3498 still ships Chromium 80, still disables the sandbox and continues to apply switches that remove web security protections.

Among 41 Chromium V8 vulnerabilities listed in CISA’s Known Exploited Vulnerabilities catalog, at least 32 were fixed in Chrome releases newer than Sogou’s embedded engine. This does not establish that every one is reachable through Sogou, but it shows how far the component has fallen behind supported Chromium releases.

CISA added CVE-2021-38003 to the KEV catalog on November 03, 2021, under the name “Google Chromium V8 Memory Corruption Vulnerability.” US federal agencies had a remediation deadline of November 17, 2021, with instructions to apply vendor updates.

Other vulnerabilities affecting the vendor set represented in related product records have entered KEV during the last 90 days: CVE-2026-87491 on September 09, 2026, CVE-2026-85046 on September 04, 2026, and CVE-2022-0995 on August 26, 2026. These entries concern Debian, Fedora Project and Google rather than establishing additional flaws in Sogou itself.

Defenders should patch and investigate separately

Windows users should update Sogou Input Method to 16.3.0.3498 or later through Tencent’s automatic update mechanism. Because no manual version-checking procedure has been published, administrators may need to validate deployment through their endpoint inventory and software-management tools.

Updating closes the disclosed protocol-abuse path. It does not remove GRAYRABBIT from a system that was already compromised.

Incident responders should search for these SHA-256 hashes:

29c7ee41d0cc9e07d981e451df56d0c3d37c41ac4ec10c7b516cc033ee397a63  7z.dll
749160a2f20f82744026719cf72e483595c6aad718efa74d675a98662e02422e  p
d7a3c7eb94edc0e020f74c678743d71d61e944634aade4a67a96c3589e828b3a  core.dll

Relevant network indicators are mail.uaiubifas[.]top, the exploit host noht1ng[.]top, and staging address 8.218.50[.]207.

Investigations should also examine C:\Users\Public\Documents\ for 7-Zip execution, alternate data streams, deleted-file remnants and the named payloads. Historical DNS, proxy, email and chat telemetry may reveal delivery even when the loader is no longer present.

Finally, defenders should inspect port 443 traffic for sessions that do not negotiate TLS. RC4-obfuscated plain TCP to the command domain may expose GRAYRABBIT activity that would otherwise resemble ordinary outbound HTTPS by port number alone.