Sogou Input Method Flaw Let UNC3569 Deliver GRAYRABBIT Backdoor with a Single Click
Summary
Researchers say UNC3569 exploited CVE-2026-51990 in Sogou Input Method to deliver GRAYRABBIT via a crafted link. Tencent patched the exploit path in version 16.3.0.3498, though the embedded browser remains outdated and insecurely configured.
Key points
- CVE-2026-51990 chained unvalidated command-line arguments and unrestricted URL navigation to open an attacker-controlled page in Sogou Input Method’s embedded browser.
- The browser used Chromium 80, ran without a sandbox, and had web security disabled, enabling the exploit chain to achieve code execution after a victim clicked a crafted link.
- Gen Threat Labs observed UNC3569 exploiting the flaw with a JavaScript exploit for CVE-2021-38003 in Chromium’s V8 engine.
- The attackers used shellcode to download components, sideload a trojanized 7-Zip DLL, and deploy the GRAYRABBIT backdoor.
- GRAYRABBIT supports remote command execution, interactive shell access, system-information collection, file transfer, and loading plugins.
- Tencent fixed the external protocol-handler exploit path in version 16.3.0.3498; the article recommends users update.
- The embedded CEF browser remains outdated, unsandboxed, and configured with security protections disabled.
Article Details
- Attack Vectors
- A victim clicking a crafted sgbiz: link launches SGMyInput.exe with attacker-supplied arguments, causing its skincenter webview to navigate to an attacker-controlled exploit page.
- The exploit page uses JavaScript targeting CVE-2021-38003 in the bundled Chromium 80 engine to achieve code execution.
- Shellcode downloads GRAYRABBIT components from a staging server and launches 7z.exe alongside a trojanized 7z.dll to sideload the loader.
- Defensive Notes
- Update Sogou Input Method to version 16.3.0.3498 or later; the article reports that the fix was deployed through automatic updates.
- The fix validates URL-bearing switches and permits only HTTPS URLs whose host matches the stated allowlist.
- The article reports that the embedded CEF configuration and browser version remain unchanged after the fix, including disabled sandboxing and web security controls.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | mail[.]uaiubifas[.]top | GRAYRABBIT C2 domain used over raw TCP on port 443. |
| DOMAIN | noht1ng[.]top | Domain hosting the exploit page delivered in the observed intrusion. |
| IPV4 | 8[.]218[.]50[.]207 | Staging server used to host files downloaded by the shellcode. |
| SHA256 | 29c7ee41d0cc9e07d981e451df56d0c3d37c41ac4ec10c7b516cc033ee397a63 | Hash of the trojanized DLL loader identified as 7zp.dll, internal name boy.dll. |
| SHA256 | 749160a2f20f82744026719cf72e483595c6aad718efa74d675a98662e02422e | Hash of the encrypted PE loader shellcode identified as p. |
| SHA256 | d7a3c7eb94edc0e020f74c678743d71d61e944634aade4a67a96c3589e828b3a | Hash of the GRAYRABBIT backdoor, internal name core.dll. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe payload contains an XOR-encrypted GRAYRABBIT PE that is decrypted by an embedded shellcode stub.T1041 · Exfiltration Over C2 ChannelGRAYRABBIT supports uploading a local file to its C2.T1057 · Process DiscoveryThe loader enumerates running processes to calculate its anti-sandbox gate.T1059.003 · Windows Command ShellGRAYRABBIT can start an interactive reverse shell by launching cmd with piped input and output.T1059.007 · JavaScriptThe exploit page uses JavaScript to exploit CVE-2021-38003.T1070.004 · File DeletionThe trojanized DLL renames its default data stream to an NTFS alternate data stream and marks the file for deletion.T1082 · System Information DiscoveryGRAYRABBIT collects the host IP address, hostname, username, process name, and PID for its system-information beacon.T1095 · Non-Application Layer ProtocolGRAYRABBIT communicates with its C2 over raw TCP rather than TLS.T1105 · Ingress Tool TransferShellcode downloads the 7z.exe, trojanized DLL, and encrypted payload from the staging server.T1203 · Exploitation for Client ExecutionThe exploit page targets a Chromium V8 vulnerability to obtain code execution in the browser process.T1204.001 · Malicious LinkThe exploit chain is triggered when a victim clicks the crafted sgbiz: link.T1497.001 · System ChecksThe loader counts running processes and derives an incorrect decryption key when the count indicates a sandbox.T1573.001 · Symmetric CryptographyGRAYRABBIT encrypts its fixed-size C2 frames with RC4 using a static key.T1574.002 · DLL Side-LoadingThe loader is saved as 7z.dll beside legitimate 7z.exe and is loaded when that executable starts.T1620 · Reflective Code LoadingGRAYRABBIT reflectively maps its PE into memory, and its plugin loader reflectively maps downloaded modules.
CVE
CVE-2021-38003The exploit page at noht1ng.top served a JavaScript exploit for CVE-2021-38003, a V8 type confusion vulnerability in JSON.stringify that affects Chrome versions prior to 95.0.4638.69.CVE-2026-51990Gen Threat Labs discovered a critical remote code execution vulnerability (CVE-2026-51990) in Sogou Input Method, one of the most widely used Chinese-language input method editors with hundreds of millions of
Threat Actors
Malware
GRAYRABBITWe observed this vulnerability actively exploited in the wild by the UNC3569 threat group to deploy the GRAYRABBIT backdoor through a crafted link.RABBITFURcomponents from an open directory server hosted on Alibaba Cloud, is functionally reminiscent of RABBITFUR, the proprietary downloader that Google Threat Intelligence has documented as UNC3569's standard
Vendors
Alibaba CloudThe downloader's role, fetching GRAYRABBIT components from an open directory server hosted on Alibaba Cloud, is functionally reminiscent of RABBITFUR, the proprietary downloader that Google Threat Intelligence hasTencentThe vulnerability was reported to Tencent, who owns and develops Sogou Input Method, and has since been fixed.
Products
7-Zip7z.exe: a legitimate 7-Zip binary, used as a sideloading hostChromiumhandler, unrestricted URL navigation in a CEF-based webview, and a severely outdated, unsandboxed Chromium browser engine.Sogou Input MethodGen Threat Labs discovered a critical remote code execution vulnerability (CVE-2026-51990) in Sogou Input Method, one of the most widely used Chinese-language input method editors with hundreds of millions of
Countries
ChinaIf you are reading this on a computer in China, there is a good chance you have Sogou Input Method installed.Hong KongThe shellcode fetched three files from a staging server at 8.218.50[.]207 (Alibaba Cloud, Hong Kong), consistent with UNC3569's well-documented preference for Alibaba Cloud infrastructure in the Hong Kong and SingaporeSingaporewith UNC3569's well-documented preference for Alibaba Cloud infrastructure in the Hong Kong and Singapore regions:
Industries
EducationThe group has conducted cyber operations against government, education, technology, and finance sectors worldwide, with a concentration in East and Southeast Asia.financeThe group has conducted cyber operations against government, education, technology, and finance sectors worldwide, with a concentration in East and Southeast Asia.GovernmentThe group has conducted cyber operations against government, education, technology, and finance sectors worldwide, with a concentration in East and Southeast Asia.TechnologyThe group has conducted cyber operations against government, education, technology, and finance sectors worldwide, with a concentration in East and Southeast Asia.