UNC3569 used Sogou IME flaw to deploy GrayRabbit

Researchers at Gen Threat Labs reported that the China-linked threat group UNC3569 exploited a critical vulnerability in Tencent’s Sogou Input Method to run code on Windows systems and deploy the GrayRabbit backdoor. The exploit used specially crafted sgbiz protocol URLs that a target user could open with a single click.

The flaw, tracked as CVE-2026-51990, chained three weaknesses in the IME’s protocol handler and its embedded browser. The protocol handler (biz_helper.exe) did not validate the param parameter in sgbiz URLs, allowing attackers to inject command-line arguments. Those arguments could force the IME to load a declared skincenter page. The product’s internal browser would then navigate to that page without additional checks.

The embedded browser in the affected Sogou build is based on Chromium 80, released in March 2020. Gen Threat Labs found the browser instance had its sandbox disabled, removed several protections including same-origin enforcement, and could read local files. Combined with the injected command-line arguments and unrestricted URL navigation, the defects allowed attackers to execute commands at system level when a user clicked a malicious link.

UNC3569 has a record of targeting organizations in government, education, technology and finance. Gen Threat Labs has tracked the GrayRabbit backdoor in the group’s intrusions since at least 2021. GrayRabbit provides a reverse shell, can run processes, load plugins, write to an interactive shell, upload files to a command-and-control server, collect system information and remove itself.

Gen Threat Labs reported CVE-2026-51990 to Tencent on April 9. Tencent released a patched build, Sogou Input Method version 16.3.0.3498, and distributed it through the product’s automatic update mechanism. The update added a check for URL-bearing switches in the protocol handler to block injected command-line arguments. As of September 10, Gen Threat Labs reported the embedded Chromium version and configuration in the product had not been updated.

Gen Threat Labs recommended that users apply the Sogou update promptly and that software vendors keep embedded browser components up to date and sandboxed to limit similar risks.