China-Aligned Espionage Group Exploits Tencent Sogou Input Method Flaw to Deploy GrayRabbit Backdoor

A critical, one-click remote code execution vulnerability in the widely used Tencent Sogou Input Method for Windows is being actively weaponized by a sophisticated, China-aligned threat group. Tracked as CVE-2026-51990, the security flaw allows malicious actors to deliver the advanced GrayRabbit backdoor via crafted hyperlinks. Researchers from cybersecurity firm Gen Digital revealed that the exploit chain targets hundreds of millions of users globally, leveraging a combination of protocol handler flaws and an outdated, unsandboxed Chromium browser component built directly into the popular typing software.

The discovery underscores a growing trend among state-sponsored and contractor-for-hire threat groups: weaponizing legitimate, high-install-base enterprise and consumer desktop applications to achieve initial access. As software ecosystems grow increasingly integrated, desktop utilities that feature built-in web rendering engines have transformed into high-value attack surfaces.

Anatomy of the Exploit Chain: Chaining Three Vulnerabilities

According to telemetry and technical analysis published by Gen Threat Labs, the active exploitation campaign is orchestrated by UNC3569, a threat actor with documented ties to Chinese cyber espionage and contractor-for-hire ecosystems. The attack relies on a sophisticated three-stage exploit chain that cleverly abuses the native functionalities of the Sogou Input Method, a dominant application utilized by hundreds of millions of individuals primarily in China to input Chinese characters using standard QWERTY keyboards.

The assault begins when an unsuspecting target clicks on a maliciously crafted custom URI, specifically utilizing the sgbiz:// scheme. This user interaction forces the Windows operating system to invoke the Sogou application’s protocol handler, designated as biz_helper.exe. Crucially, this component historically suffered from an input validation failure, blindly accepting attacker-controlled command-line arguments without properly sanitizing or verifying their contents.

In the second stage, these unvalidated arguments are passed directly to a legitimate Sogou executable, SGMyInput.exe. The injected parameters force the application to open its built-in skincenter component, instructing its embedded webview engine to navigate to an external, attacker-controlled URL. Because the Sogou architecture lacked stringent restrictions on URL schemes or destination endpoints, the application readily rendered the malicious web page without user friction.

The final stage of the attack takes full advantage of the environment’s inherent structural weaknesses. The embedded webview utilized by the application relies on an obsolete version of the Chromium engine—specifically Chromium 80. Furthermore, this browser instance operates entirely without a modern security sandbox, while multiple critical web-security mitigations are disabled by default. By loading a specially crafted exploit page into this vulnerable rendering engine, UNC3569 successfully achieves remote code execution, bypassing host-level defenses and silently installing the GrayRabbit backdoor onto the compromised Windows host.

Evolution of the GrayRabbit Backdoor and UNC3569

GrayRabbit is not a new tool in the arsenals of targeted threat actors. Initially brought to public prominence in 2024 by security researchers from Google, the malware was documented as a highly modular, versatile threat family tied closely to the UNC3569 group. At the time, analysts identified UNC3569 as an agile actor operating across the blurred lines of traditional financially motivated cybercrime and state-directed cyber espionage operations.

However, the recent analysis by Gen Threat Labs highlights a significant technological evolution in the malware’s architecture. The newly analyzed samples of GrayRabbit represent a more mature, robust 64-bit variant equipped with an expanded command set and sophisticated operational security measures, including RC4-encoded communications configuration for its command-and-control (C2) infrastructure.

Once deployed on a target machine, the updated backdoor provides comprehensive control to the operator. Its expansive capabilities include:

• Executing arbitrary system processes and commands.
• Opening interactive reverse shells for real-time administrative access.
• Uploading and downloading arbitrary files to exfiltrate data or drop secondary payloads.
• Collecting granular system and user telemetry to map the host environment.
• Reflectively loading dynamic plugins directly into the host process memory to evade traditional file-based detection mechanisms.

This combination of stealth, persistence, and functional depth makes GrayRabbit a potent tool for long-term espionage and intelligence gathering, particularly when successfully seeded via trusted consumer software.

Timeline of Discovery, Disclosure, and Remediation

The rapid response by security researchers and the subsequent patch deployment by Tencent highlight the critical importance of coordinated vulnerability disclosure, albeit against a backdrop of systemic architectural challenges.

• April 9, 2026: Gen Threat Labs formally reports the critical vulnerability (CVE-2026-51990) and the associated exploit chain targeting the Sogou Input Method to Tencent.
• April 21, 2026: Tencent responds by releasing Sogou Input Method version 16.3.0.3498, which includes targeted patches designed to obstruct the initial stages of the exploit chain.
• Ongoing: Security researchers continue to evaluate the efficacy of the patch, issuing warnings regarding the underlying architectural risks posed by legacy software components.

Tencent’s patch introduces strict validation for the URL arguments accepted through the application’s custom protocol handler. Specifically, the updated software now strictly permits HTTPS schemes and restricts internal navigation exclusively to approved, legitimate domains associated with Sogou and its parent company, Tencent. These measures effectively break the first and second stages of the UNC3569 attack chain by preventing arbitrary external URLs from being loaded via the skincenter component.

Implications and Persistent Risks in Modern Software Architecture

Despite the prompt deployment of version 16.3.0.3498, cybersecurity analysts have raised persistent concerns regarding the long-term security posture of applications like the Sogou Input Method.

The primary anxiety stems from the fact that while input validation patches can successfully block specific attack vectors—such as the sgbiz:// URI abuse demonstrated by UNC3569—the underlying browser infrastructure remains fundamentally unchanged. Gen Threat Labs explicitly warned that the application continues to rely on an outdated Chromium engine operating without a sandbox, alongside numerous disabled web-security protections.

This architectural reality leaves the software vulnerable to future classes of browser-based exploits. If attackers can identify alternative pathways to force the application to load malicious content—or discover unpatched memory corruption vulnerabilities within the aging Chromium 80 core—the risk of recurrence remains exceptionally high.

Broader Industry Impact

The exploitation of CVE-2026-51990 serves as a stark reminder of the security risks inherent in "app-in-app" ecosystems and utility software that bundle heavy web-rendering dependencies. Developers frequently integrate Chromium or similar browser frameworks into desktop utilities to streamline user interfaces, manage dynamic skins, or display advertisements. However, maintaining these embedded engines requires the same rigorous, continuous patch management lifecycle applied to standalone web browsers. When development teams fail to regularly update these components or omit crucial sandboxing layers, utility software inadvertently becomes a sprawling, high-privilege backdoor into enterprise and consumer networks alike.

As nation-state actors and advanced persistent threat (APT) groups increasingly pivot toward supply-chain compromises, trusted software utilities, and protocol-handler abuses, organizations and security teams must expand their threat modeling. Monitoring endpoint telemetry for anomalous process spawns—such as a typing utility invoking webview components to connect to external, non-standard IP addresses—remains a vital defense mechanism against sophisticated campaigns like those waged by UNC3569.