Chinese Hackers Exploit Tencent Sogou Input Method to Deploy Malware

Researchers at Gen Threat Labs have reported that the Chinese-linked threat actor UNC3569 is actively exploiting a critical vulnerability in Tencent’s Sogou Input Method to deploy the GrayRabbit backdoor. The exploit allows for one-click remote code execution on Windows systems.

Sogou Input Method, a widely used Chinese-language input method editor (IME) developed by Tencent, is used by hundreds of millions of people. The threat group UNC3569, which is potentially linked to the Chinese private contractor i-SOON, has been using the flaw to target various sectors globally.

Technical Breakdown of the Exploit Chain

The vulnerability, tracked as CVE-2026-51990, involves a chain of three distinct security weaknesses. The attack targets the software’s custom protocol scheme, known as sgbiz, which uses a protocol handler called biz_helper.exe to parse URLs.

The first weakness is unvalidated command-line argument injection. During the URL parsing process, the handler fails to sanitise the ‘param’ parameter, which allows an attacker to inject arbitrary command-line arguments. This enables the attacker to declare a specific page that the browser will then navigate to.

The exploit is compounded by an outdated and insecure browser environment. The Sogou Input Method relies on a version of the Chromium browser engine from March 2020. This engine is missing approximately six years of security patches, operates with the sandbox completely disabled, and lacks essential protections such as the same-origin policy, allowing URLs to read local files.

GrayRabbit Backdoor Capabilities

UNC3569 utilizes this exploit chain to deliver the GrayRabbit backdoor. This malware has been observed in various intrusions since 2021, often targeting government, education, technology, and finance organisations.

Once a system is compromised, GrayRabbit provides attackers with a reverse shell. The backdoor allows for the execution of processes, the loading of plugins, the collection of system information, and the uploading or downloading of files via a command-and-control (C&C) server. The malware is designed to terminate itself after its tasks are complete to limit its footprint.

Patch Status and Mitigation

Tencent has released a security update to address the primary injection flaw. The defect was addressed in Sogou Input Method version 16.3.0.3498, which introduced checks for URL-bearing switches in the protocol handler.

Despite this fix, researchers noted that the underlying configuration of the Chromium engine remains unpatched. As of 10 September 2026, the software version and browser configuration had not been updated to resolve the lack of sandboxing or the outdated engine version. Users are encouraged to ensure their Sogou Input Method is updated to the latest available version to mitigate the primary injection vector.