Vulnerabilities · 44 days ago
Gen Digital found UNC3569 exploiting a flaw in Sogou Input Method during a live intrusion, and Tencent shipped a fix in version 16.3.0.3498. The attack used a crafted sgbiz: link to reach GRAYRABBIT, the backdoor the group deployed after the click. The flaw is tracked as CVE-2026-51990.
The Windows app registers a custom link handler, and the component that opens the link checks which Sogou module to start but not the arguments passed along with it. That lets attacker-controlled input ride the normal launch path and hand the attacker the same power as the logged-in user, including remote commands and file movement.
For Windows fleets that rely on Sogou Input Method, the exposure is not limited to the app itself. If a host opened one of these crafted links, the patch closes the entry point but does not undo whatever follow-on access GRAYRABBIT already created under that user account.
3 sources covering this story
Chinese Hackers Exploit Critical Tencent Software Flaw for One-Click Code Execution
The Chinese-language input method editor for Windows can allow attackers to execute arbitrary code remotely.
Hackers exploit Tencent app flaw to deploy GrayRabbit malware
Threat actors linked to a China-aligned espionage group are exploiting a critical vulnerability (CVE-2026-51990) in Tencent's Sogou Input Method for Windows to deploy the GrayRabbit backdoor.
China-Linked UNC3569 Exploited Sogou Input Method Flaw to Deploy GRAYRABBIT Backdoor
China-linked UNC3569 exploited a Sogou Input Method flaw to deploy GRAYRABBIT; Tencent fixed the issue in version 16.3.0.3498.
Part of the PlainSec briefing for 2026-09-15