Gen Digital has published research on a China-linked intrusion in which the group tracked as UNC3569 — placed by Google Threat Intelligence in China's hacker-for-hire scene and tracked by Google since 2021 as a threat to government, education, technology and finance sectors, mostly in East and Southeast Asia — exploited a vulnerability in Sogou Input Method to install the GRAYRABBIT backdoor. Sogou Input Method is one of the most widely used tools for typing Chinese characters on Windows, which gives any exploit in it an extremely broad potential victim base, and Tencent, which owns and develops Sogou, fixed the flaw in April 2026. The attack chain started with a crafted link and ended with the attacker able to do anything the logged-in user could, via a small backdoor the group has used for years and which Google describes as its first step onto a machine. Gen Digital found the flaw while investigating a live intrusion rather than through proactive vulnerability research, meaning the exposure window between fix and discovery of exploitation was measured in months.
| Attribute | Detail |
|---|---|
| Sector | Defence |
| Date | 2026-09-12 |
| Source | The Hacker News |
| Reliability | Tier 2 |
Escalation — 2026-09-14: the CVE is named and the full chain is published
Gen Digital's complete write-up, reported on 11–13 September 2026, named the flaw as CVE-2026-51990 and set out the three chained weaknesses behind the single-click compromise: an unvalidated command-line argument injection in the product's sgbiz: URI handler, unrestricted URL navigation in a CEF-based webview, and the outdated, unsandboxed Chromium 80 engine bundled inside the input method itself. A victim clicking a crafted sgbiz: link has Windows invoke Sogou's biz_helper.exe protocol handler, which forwards attacker-controlled arguments to the legitimate SGMyInput.exe executable; those arguments open the skincentre component and direct the embedded webview at an attacker-controlled page, which exploits the old browser engine to reach code execution.
Tencent's April 2026 fix — Sogou Input Method 16.3.0.3498 — validates the URL arguments accepted through the protocol handler, permits only HTTPS and restricts navigation to approved Sogou and Tencent domains. Gen Digital warns that the underlying browser engine remains outdated and unsandboxed, so the patch closes the documented chain without removing the class of weakness underneath it. The analysed GRAYRABBIT sample is a more mature 64-bit variant with an expanded command set and an RC4-encoded command-and-control configuration, capable of process execution, interactive reverse shells, file transfer, system and user enumeration, and reflective plugin loading.
The CVE identifier and the chain mechanics are recorded separately as their own vulnerability page (CVE-2026-51990).