China-Aligned Espionage Group Exploits Critical Tencent Sogou Input Method Flaw to Deploy GrayRabbit Backdoor

A sophisticated China-aligned threat actor has been actively exploiting a critical, one-click remote code execution vulnerability in Tencent’s immensely popular Sogou Input Method for Windows. Cybersecurity researchers from Gen Threat Labs disclosed that the flaw—cataloged as CVE-2026-51990—is being weaponized in targeted attacks to deliver an upgraded, mature variant of the modular GrayRabbit backdoor.

The campaign underscores a persistent and dangerous trend in modern cyber espionage: the exploitation of widely trusted, everyday desktop utilities that possess native browser components, complex protocol handlers, and deep integration into the Windows operating system. With hundreds of millions of installations primarily concentrated in China, the Sogou Input Method represents a massive potential attack surface, making vulnerabilities within its architecture exceptionally high-value targets for advanced persistent threat (APT) groups.

Anatomy of the Exploit Chain

According to technical analysis published by Gen Threat Labs, the exploitation mechanism relies on a sophisticated three-stage attack chain that cleverly abuses legitimate internal application features. The operation begins when an unsuspecting user is lured into clicking a maliciously crafted custom URI link utilizing the sgbiz: protocol scheme.

Upon clicking the link, Windows immediately invokes Sogou’s biz_helper.exe protocol handler. Security researchers discovered that this handler suffers from a critical lack of input validation, allowing threat actors to pass arbitrary, attacker-controlled command-line arguments directly to a legitimate underlying executable known as SGMyInput.exe.

In the second stage of the attack, these injected arguments force Sogou’s built-in skin-customization component—the skincenter—to launch. Crucially, the application instructs its embedded webview, powered by an outdated Chromium engine, to navigate to an attacker-controlled external URL. Because the software failed to enforce proper validation on URL schemes or destination endpoints during this phase, the application willingly loaded untrusted remote content.

The final stage leverages the embedded webview’s inherent architectural weaknesses. The malicious page rendered within the application exploits a known vulnerability residing within Sogou’s outdated Chromium 80 engine. Compounding the risk, this embedded browser instance operates entirely without a sandbox environment and has vital web-security mitigations disabled. This combination allows the exploit to break out of the browser context, achieve arbitrary remote code execution on the host machine, and successfully install the GrayRabbit backdoor without requiring administrative privileges or triggering standard system warnings.

The UNC3569 Threat Actor and the GrayRabbit Backdoor

The threat group responsible for these attacks has been tracked by the cybersecurity community under the designation UNC3569. Security researchers have previously characterized UNC3569 as a China-based threat actor that operates fluidly across both traditional cybercrime ecosystems and state-aligned contractor-for-hire frameworks.

GrayRabbit itself is far from a newly discovered threat. Google researchers first documented the malware family in detail during late 2024, outlining its modular design and its primary association with UNC3569 operations. However, the variant analyzed by Gen Threat Labs in connection with the current campaign represents a significantly more mature, 64-bit evolution of the software.

This upgraded iteration of GrayRabbit features an expanded command set and employs robust RC4-encoded configurations for its command-and-control (C2) communications, allowing operators to maintain stealthy and persistent access to compromised networks. Once successfully deployed, the backdoor provides attackers with a comprehensive suite of post-exploitation capabilities. These include arbitrary process execution, the opening of interactive reverse shells for real-time system manipulation, file upload and download functionalities, extensive system and user information harvesting, and the ability to reflectively load additional malicious plugins directly into the host’s volatile memory to evade file-based detection systems.

Timeline of Discovery and Remediation

The lifecycle of the vulnerability highlights a coordinated, albeit compressed, disclosure and patching timeline between the security research community and the software vendor.

• April 9, 2026: Gen Threat Labs formally reported its findings regarding CVE-2026-51990 and the active exploitation campaigns observed in the wild to Tencent security teams.
• April 21, 2026: Tencent responded by releasing a security update for the application, designated as Sogou Input Method version 16.3.0.3498.

The vendor-issued patch implemented critical input validation measures on the URL arguments accepted through the vulnerable protocol handler. Specifically, the updated software now strictly permits only HTTPS connections and restricts web navigation exclusively to approved, trusted domains officially associated with Sogou and Tencent.

Despite the release of version 16.3.0.3498, cybersecurity experts have issued cautionary notes regarding the completeness of the fix. Researchers pointed out that while the protocol handler validation successfully blocks the initial injection vector used in recent campaigns, the underlying Chromium browser engine remains fundamentally outdated. Furthermore, the application continues to execute the browser instance without a proper sandboxing environment and with several core web security protections disabled, leaving the architecture vulnerable to alternative exploitation vectors if future flaws are discovered within the outdated engine components.

Broader Implications for Software Architecture and Enterprise Security

The exploitation of the Sogou Input Method serves as a critical case study regarding the hidden security risks inherent in modern software design. Desktop utilities, productivity tools, and browser extensions frequently incorporate embedded web rendering engines to display dynamic content, user interfaces, or update screens. When these embedded engines are neglected, fail to receive regular upstream updates, or run without modern operating system-level mitigations such as sandboxing, they effectively transform benign applications into high-risk entry points for malicious actors.

Furthermore, the reliance on custom protocol handlers—such as sgbiz:—without rigorous input sanitization continues to plague desktop software ecosystems. Protocol handlers are designed to streamline user experience by allowing seamless transitions between web browsers and desktop applications, but they are frequently abused by threat actors to smuggle malicious commands past perimeter defenses.

For enterprise security teams and organizations operating in regions with high usage of localized productivity software, the incident highlights the necessity of rigorous application whitelisting, continuous endpoint monitoring, and strict visibility into auxiliary utilities running on corporate endpoints. As threat actors increasingly pivot toward supply-chain compromises, living-off-the-land techniques, and the weaponization of trusted consumer utilities, defenders must look beyond traditional antivirus signatures and focus on behavioral anomalies associated with unexpected process spawn chains and unauthorized network connections originating from non-browser applications.