UNC3569 Exploitation of Sogou Input Method to Deploy GRAYRABBIT Backdoor

UNC3569, a China-linked hacker-for-hire group, has been observed exploiting a vulnerability (CVE-2026-51990) in the Sogou Input Method to deploy the GRAYRABBIT backdoor on Windows systems. The attack chain leverages the application's 'sgbiz:' protocol handler, which failed to sanitize command-line arguments. By passing malicious arguments to the 'biz_helper.exe' component, attackers forced an internal, outdated (Chromium 80, circa 2020), and sandbox-disabled browser component to visit an attacker-controlled site. This site delivered an exploit for CVE-2021-38003, enabling arbitrary code execution. The final payload, GRAYRABBIT, is a modular backdoor known to the threat actor for years, which performs process enumeration and exfiltration via non-TLS traffic on port 443. Tencent released a patch in version 16.3.0.3498 in April 2026. Defenders should note that while the patch prevents the argument injection, the underlying browser component remains significantly outdated.

Attack Chain

1. The attacker convinces a user to click a crafted link using the 'sgbiz:' protocol handler.
2. Windows passes the link to 'biz_helper.exe', which fails to validate command-line arguments.
3. The handler executes 'SGMyInput.exe' with parameters pointing to an attacker-controlled URL via the application's internal Chromium-based 'skin store' window.
4. The outdated Chromium v80 component, running without sandbox protections, loads a webpage containing an exploit for CVE-2021-38003.
5. The V8 engine exploit triggers arbitrary code execution in the context of the user.
6. A downloader is executed, fetching a malicious DLL and encrypted payload from an Alibaba Cloud staging server (8.218.50.207) into 'C:\Users\Public\Documents'.
7. The system's '7-Zip' utility is launched, triggering DLL sideloading of the malicious DLL disguised as a legitimate 7-Zip component.
8. The GRAYRABBIT backdoor (core.dll) initializes, performs process checks, and begins communication with 'mail.uaiubifas.top' over port 443 using RC4-scrambled traffic.

Impact

The vulnerability allows unauthenticated remote code execution with user privileges. Given Sogou Input Method's massive user base, exceeding 455 million monthly users with significant deployments in government, education, finance, and technology sectors in East and Southeast Asia, the potential for widespread compromise is significant. Successful exploitation grants attackers persistent access to sensitive data, file exfiltration capabilities, and the ability to load additional malicious modules.

Recommendation

1. Upgrade all instances of Sogou Input Method to version 16.3.0.3498 or later immediately.
2. Block the identified C2 domain 'mail.uaiubifas.top' and the staging IP '8.218.50.207' at the network perimeter.
3. Deploy the provided Sigma rule to detect the specific process-creation pattern of 'biz_helper.exe' launching 'SGMyInput.exe' with unexpected URL parameters.
4. Monitor for non-TLS traffic on port 443, which may indicate GRAYRABBIT command and control activity.
5. Hunt for artifacts in 'C:\Users\Public\Documents' consistent with the 7-Zip DLL sideloading technique.