UNC3569 / Sogou Input Method CVE-2026-51990: One-Click RCE to GRAYRABBIT

One click. No macros. No “enable content.” A China-linked group is using a flaw in Tencent’s Sogou Input Method to drop the GRAYRABBIT backdoor. The IME sits on hundreds of millions of Windows PCs.

If your estate includes Chinese-language endpoints (or contractors who bring their own), treat Sogou version checks as a real inventory item rather than a niche edge case.

One-click RCE via Sogou’s URI handler

Gen Threat Labs (Gen Digital) disclosed a critical one-click remote code execution chain in Sogou Input Method for Windows. They observed UNC3569 (China-linked; tracked by Google Threat Intelligence across cybercrime and contractor-for-hire activity) exploiting it in the wild to deploy GRAYRABBIT via a crafted link.

Public coverage landed September 13–14, 2026. The chain stacks three weaknesses: a broken custom URI handler, an unrestricted in-app webview, and an old unsandboxed Chromium engine.

A click opens the IME; GRAYRABBIT follows

Custom protocol handlers are an easy blind spot. Users click a link; the IME opens it; malware lands. GRAYRABBIT is UNC3569’s long-running first-stage implant. Expect follow-on modules rather than a single binary.

Confirm version 16.3.0.3498 or remove Sogou

• Confirm Sogou Input Method for Windows is ≥ 16.3.0.3498. Remove or block it where there’s no business need.
• Don’t assume auto-update worked. Spot-check versions on high-risk and contractor endpoints.
• Hunt for the process and DLL patterns listed under Hunt / verify.
• Watch for traffic to Gen-published C2 indicators (including mail.uaiubifas[.]top).

Details

• CVE: CVE-2026-51990
• Product: Tencent Sogou Input Method for Windows
• Actor / malware: UNC3569 → GRAYRABBIT
• Fix: ≥ 16.3.0.3498 (auto-update push April 21, 2026, after Gen’s April 9 report)
• Patch note: Handler now restricts URL args to HTTPS and approved Sogou/Tencent domains. Gen says the embedded Chromium is still outdated and unsandboxed after the handler fix.

Exploit chain (compact)

1. Argument injection in the sgbiz: URI handler (biz_helper.exe → SGMyInput.exe).
2. Unrestricted URL navigation in the CEF-based skincenter webview.
3. Outdated, unsandboxed Chromium 80, abused with a known V8 bug (CVE-2021-38003) for code execution.

Observed post-exploit: 7z.exe DLL sideloading (7z.dll) to load an x64 GRAYRABBIT implant (core.dll exports CoreClientInstall / CoreClientStart). Capabilities include reverse shell, process execution, file transfer, recon, and in-memory plugins.

Hunt / verify

• Process ancestry: biz_helper.exe / SGMyInput.exe with -page=skincenter and attacker -url= args; sgbiz: protocol launches.
• 7z.exe loading unexpected 7z.dll; writes under C:\Users\Public\Documents\.
• Outbound to Gen C2 indicators, including mail.uaiubifas[.]top (RC4-encoded config; TLS-style traffic on atypical ports per Gen/THN).

Sources

• Gen Digital: Gray Rabbits and the Tale of a One-Click Backdoor
• BleepingComputer: Hackers exploit Tencent app flaw to deploy GrayRabbit (Sep 13, 2026)
• SecurityWeek: Chinese hackers exploit critical Tencent software flaw (Sep 14, 2026)
• The Hacker News: UNC3569 / Sogou / GRAYRABBIT

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].