A sophisticated China-linked hacking group, identified as **UNC3569**, has been caught exploiting a critical flaw in **Sogou Input Method**, a dominant tool for Chinese character input on Windows. The exploit allowed the installation of the **GRAYRABBIT** backdoor on victims' computers, as detailed in recent research by **Gen Digital**. The attack initiated with a specially crafted link. Upon interaction, it enabled attackers to gain the same privileges as the logged-in user, effectively taking full control of the system. ### UNC3569: A Persistent Threat **Gen Digital** uncovered this vulnerability during an active intrusion investigation by **UNC3569**. This group, which **Google Threat Intelligence** links to China's 'hacker-for-hire' ecosystem, has been active since 2021. Their targets primarily include government, education, technology, and finance sectors across East and Southeast Asia. The **GRAYRABBIT** backdoor, used by **UNC3569** for years, serves as their initial foothold. It provides a remote command shell, facilitates file transfers, and can load additional modules from the attacker's server at any time. ### The Sogou Vulnerability: A Chain of Flaws **Sogou Input Method** boasts a substantial user base, with **Citizen Lab** at the University of Toronto reporting over 455 million monthly users across Windows, Android, and iOS in 2023. The vulnerability discovered by **Gen Digital** resides in the Windows version.  The attack chain exploited several weaknesses: 1. **Unfiltered Link Handling**: **Sogou Input Method** utilizes a custom link type, `sgbiz:`, to communicate between its components. The `biz_helper.exe` handler, responsible for processing these links, failed to adequately filter command-line arguments. 2. **Browser Window Injection**: Attackers leveraged this by pointing the `sgbiz:` link to `SGMyInput.exe` (Sogou's settings program) and instructing it to open the skin store with an attacker-controlled web address. 3. **Outdated Chromium Engine**: The skin store's built-in browser engine is an outdated **Chromium 80** from March 2020. Crucially, its sandbox and same-origin policy were found to be disabled by design. This combination meant that a JavaScript flaw on the attacker's webpage could directly execute code on the user's machine with their privileges, requiring only a single click on the malicious link. ### Exploiting an Old Vulnerability: **CVE-2021-38003** The exploit delivered to victims leveraged **CVE-2021-38003**, a flaw in **V8**, Chrome's JavaScript engine, concerning `JSON.stringify` handling. This vulnerability, which allowed memory corruption and code execution, was patched by **Google** in Chrome 95 in October 2021 and added to **CISA's Known Exploited Vulnerabilities Catalog** shortly after. Alarmingly, **Sogou's Chromium** build never received this fix, nor many others. At least 32 **Chromium V8** flaws in **CISA's catalog** were fixed in Chrome releases that postdate the version shipped with **Sogou Input Method**. ### The **GRAYRABBIT** Payload Upon successful exploitation, a small downloader retrieved three files from an **Alibaba Cloud** server: a legitimate copy of **7-Zip**, a malicious DLL, and an encrypted payload. These were placed in `C:\Users\Public\Documents`. The malicious DLL was named `7z.dll`, a name **7-Zip** loads from its own folder at startup. Executing **7-Zip** then loaded the attacker's code instead of the legitimate one. The DLL also employed anti-analysis techniques, failing to decrypt its payload if fewer than 50 processes were running (a common state for automated malware analysis systems). The DLL then deleted itself by moving its contents into an **NTFS** alternate data stream and marking the file for deletion, leaving behind the **GRAYRABBIT** backdoor. **GRAYRABBIT** communicates with its command-and-control server at `mail.uaiubifas[.]top` over port 443, using RC4-scrambled plain TCP traffic instead of the expected TLS, making it a distinct network signature. ### The Patch and Remaining Concerns **Gen Digital** reported the flaw to **Tencent** on April 9, 2026, tracked as **CVE-2026-51990**. **Tencent** responded swiftly, confirming a fix and rolling out an automatic update (version **16.3.0.3498**) to all users by April 21, 2026. The fix primarily resides in `biz_helper.exe`, which now validates web addresses, rejecting non-HTTPS links and checking hostnames against an allowlist (`sogou.com`, `qq.com`, `woa.com`, `sogou`). However, the underlying browser engine remains untouched. **Chromium 80** is still present, with its sandbox and web security flags still disabled. While external parties can no longer direct it to arbitrary addresses, **Gen Digital** emphasizes that these components require further security hardening. ### Recommendations IT security professionals and privacy-conscious users of **Sogou Input Method** are urged to: * **Update Immediately**: Ensure **Sogou Input Method** is updated to version **16.3.0.3498** or later. **Tencent** stated this update was automatically pushed to users on April 21, 2026. * **Monitor for Indicators of Compromise (IoCs)**: If a system may have been compromised before the patch, look for the following IoCs, although the loader deletes itself: * **SHA-256**: `29c7ee41d0cc9e07d981e451df56d0c3d37c41ac4ec10c7b516cc033ee397a63` (malicious DLL loader, written as `7z.dll`) * **SHA-256**: `749160a2f20f82744026719cf72e483595c6aad718efa74d675a98662e02422e` (encrypted payload file, named `p`) * **SHA-256**: `d7a3c7eb94edc0e020f7` (likely partial hash for **GRAYRABBIT** backdoor) * **Network Monitoring**: Watch for non-TLS traffic on port 443 originating from **Sogou Input Method** processes, especially connections to `mail.uaiubifas[.]top`. Neither **Gen Digital** nor **Tencent** has specified all affected versions or provided guidance on how to check the installed version, adding to the challenge for users. Furthermore, it remains unclear if installing the patch removes an already running backdoor.