UNC3569 / Sogou Input Method CVE-2026-51990: One-Click RCE to GRAYRABBIT

One click. No macros. No “enable content.” A China-linked group is using a flaw in Tencent’s Sogou Input Method to drop the GRAYRABBIT backdoor — and the IME sits on hundreds of millions of Windows PCs.

If your estate includes Chinese-language endpoints (or contractors who bring their own), treat Sogou version checks as a real inventory item, not a niche edge case.

What happened

Gen Threat Labs (Gen Digital) disclosed a critical one-click remote code execution chain in Sogou Input Method for Windows. They observed UNC3569 (China-linked; tracked by Google Threat Intelligence across cybercrime and contractor-for-hire activity) exploiting it in the wild to deploy GRAYRABBIT via a crafted link.

Public coverage landed September 13–14, 2026. The chain stacks three weaknesses: a broken custom URI handler, an unrestricted in-app webview, and an old unsandboxed Chromium engine.

Why it matters

Custom protocol handlers are an easy blind spot. Users click a link; the IME opens it; malware lands. GRAYRABBIT is UNC3569’s long-running first-stage implant — expect follow-on modules, not a one-and-done binary.

What to do first

• Confirm Sogou Input Method for Windows is ≥ 16.3.0.3498. Remove or block it where there’s no business need.
• Don’t assume auto-update worked — spot-check versions on high-risk and contractor endpoints.
• Hunt for the process and DLL patterns listed under Hunt / verify.
• Watch for traffic to Gen-published C2 indicators (including mail.uaiubifas[.]top).

Details

• CVE: CVE-2026-51990
• Product: Tencent Sogou Input Method for Windows
• Actor / malware: UNC3569 → GRAYRABBIT
• Fix: ≥ 16.3.0.3498 (auto-update push April 21, 2026, after Gen’s April 9 report)
• Patch note: Handler now restricts URL args to HTTPS and approved Sogou/Tencent domains. Gen says the embedded Chromium is still outdated and unsandboxed after the handler fix.

Exploit chain (compact)

1. Argument injection in the sgbiz: URI handler (biz_helper.exe → SGMyInput.exe).
2. Unrestricted URL navigation in the CEF-based skincenter webview.
3. Outdated, unsandboxed Chromium 80, abused with a known V8 bug (CVE-2021-38003) for code execution.

Observed post-exploit: 7z.exe DLL sideloading (7z.dll) to load an x64 GRAYRABBIT implant (core.dll exports CoreClientInstall / CoreClientStart). Capabilities include reverse shell, process execution, file transfer, recon, and in-memory plugins.

Hunt / verify

• Process ancestry: biz_helper.exe / SGMyInput.exe with -page=skincenter and attacker -url= args; sgbiz: protocol launches.
• 7z.exe loading unexpected 7z.dll; writes under C:\Users\Public\Documents\.
• Outbound to Gen C2 indicators, including mail.uaiubifas[.]top (RC4-encoded config; TLS-style traffic on atypical ports per Gen/THN).

Sources

• Gen Digital: Gray Rabbits and the Tale of a One-Click Backdoor
• BleepingComputer: Hackers exploit Tencent app flaw to deploy GrayRabbit (Sep 13, 2026)
• SecurityWeek: Chinese hackers exploit critical Tencent software flaw (Sep 14, 2026)
• The Hacker News: UNC3569 / Sogou / GRAYRABBIT

George Bailey

George Bailey is a cybersecurity researcher and writer at CyberExperts, covering cyber threats, AI, cloud security, vulnerabilities, and defensive strategies. His goal is to help security professionals quickly understand what matters most and how it impacts their organizations.