China-Aligned Espionage Group Exploits Critical Tencent Sogou Flaw to Deploy GrayRabbit Malware

A sophisticated China-aligned cyber espionage threat actor known as UNC3569 has been actively exploiting a critical, one-click remote code execution vulnerability within Tencent’s widely used Sogou Input Method for Windows. Tracked under the identifier CVE-2026-51990, the security flaw allows attackers to compromise target systems by tricking unsuspecting users into clicking on specially crafted hyperlinks. Cybersecurity researchers at Gen Threat Labs revealed that this vulnerability is being leveraged in the wild to deliver an advanced, newly matured iteration of the modular GrayRabbit backdoor.

The discovery underscores the persistent risk associated with ancillary software components—such as built-in web browsers and custom protocol handlers—bundled into popular desktop applications. With hundreds of millions of installations primarily concentrated in China, the Sogou Input Method represents an expansive attack surface, making vulnerabilities within its architecture prime targets for state-sponsored threat actors seeking persistent footholds in high-value environments.

Anatomy of the Attack Chain: Chaining Three Weaknesses

The exploitation vector uncovered by Gen Digital researchers relies on a complex, multi-stage attack chain that cleverly abuses native application features to bypass traditional security perimeters. The entire operation is initiated when a target clicks a malicious link featuring a customized URI scheme (sgbiz:). This seemingly innocuous action compels the Windows operating system to invoke the legitimate Sogou protocol handler, biz_helper.exe.

Crucially, biz_helper.exe failed to properly sanitize or validate incoming command-line arguments. Taking advantage of this oversight, the attackers inject malicious parameters that force the application to launch its built-in skin-management component (skincenter). This component subsequently commands an embedded Chromium webview to navigate to an attacker-controlled external URL. Because the application lacked proper restrictions governing URL schemes and navigation destinations, the browser readily opened the malicious remote resource.

The final stage of the compromise leverages a well-documented vulnerability residing within the application’s underlying web rendering engine. The Sogou Input Method utilized an outdated version of the Chromium engine—specifically Chromium 80—which lacked modern security mitigations. Compounding the risk, this embedded browser instance operated entirely without a sandbox environment, while disabling numerous fundamental web security protections. Once the malicious page rendered within this unprotected environment, the exploit successfully executed arbitrary code, culminating in the silent installation and persistence of the GrayRabbit backdoor.

Evolution and Capabilities of the GrayRabbit Backdoor

GrayRabbit is not a new threat to the cybersecurity landscape, but its operational maturity has evolved significantly. Initially documented by Google threat intelligence researchers in 2024, the malware family was formally attributed to UNC3569, a threat actor group operating at the intersection of traditional cybercrime and the state-sponsored contractor-for-hire ecosystem. While early versions of GrayRabbit possessed standard administrative and espionage features, the samples analyzed by Gen Threat Labs in connection with CVE-2026-51990 demonstrate a notable technological upgrade.

The contemporary 64-bit variant of GrayRabbit features a heavily expanded command set and utilizes RC4-encoded communications to obfuscate its interactions with command-and-control (C2) infrastructure. Once successfully deployed on a compromised Windows host, the backdoor endows operators with extensive post-exploitation capabilities. These include arbitrary process execution, the spawning of interactive reverse shells for real-time command execution, comprehensive file upload and download functionalities, and deep reconnaissance capabilities designed to harvest sensitive system and user metadata. Furthermore, the malware possesses the ability to reflectively load modular plugins directly into the host system’s memory, minimizing its disk footprint and evading traditional file-based detection mechanisms.

Timeline of Discovery, Disclosure, and Patching

The discovery and subsequent remediation of CVE-2026-51990 followed a standard responsible disclosure lifecycle, highlighting the rapid response capabilities of both security researchers and software vendors when faced with active in-the-wild exploitation.

The timeline of the event highlights the following key milestones:

• 2024: Google researchers publish foundational research detailing the modular architecture of the GrayRabbit malware and link its deployment to the UNC3569 threat actor group.
• Early 2026: Gen Threat Labs observes active exploitation campaigns leveraging a novel one-click attack vector targeting Windows users via customized URI schemes.
• April 9, 2026: Gen Threat Labs officially reports its findings regarding the critical flaw in the Sogou Input Method to Tencent, providing technical documentation of the three-stage exploit chain.
• April 21, 2026: Tencent releases Sogou Input Method version 16.3.0.3498, deploying a security patch designed to neutralize the attack vector.

The software patch implemented by Tencent fundamentally alters how the application handles external requests. Specifically, the updated version introduces strict validation checks for URL arguments accepted through the custom protocol handler. The fix restricts permitted protocol schemes exclusively to HTTPS and enforces rigid domain whitelisting, ensuring that navigation is limited to approved domains officially associated with Sogou and its parent company, Tencent.

Persistent Architectural Risks and Defensive Implications

Despite the prompt deployment of version 16.3.0.3498, cybersecurity analysts and researchers have raised ongoing concerns regarding the long-term security posture of the application. While the patch successfully closes the specific entry point exploited by UNC3569 via the protocol handler, the underlying architecture of the Sogou Input Method retains inherent structural risks.

Most notably, security researchers have pointed out that the embedded browser engine remains outdated, and the application continues to execute browser components without utilizing a modern sandboxing framework. Furthermore, a significant portion of standard web security protections remain disabled within the embedded Chromium environment. This leaves open the theoretical possibility that alternative vulnerabilities could be discovered and exploited if threat actors manage to bypass the newly implemented domain restrictions or discover auxiliary flaws within the application’s peripheral components.

The exploitation of CVE-2026-51990 serves as a stark reminder of the unique risks introduced by third-party desktop applications that incorporate complex web-rendering engines and custom URI handlers. For enterprise security teams, the incident emphasizes the critical need for rigorous application control policies, continuous endpoint monitoring, and the prompt auditing of auxiliary software installed on corporate networks. As state-sponsored espionage groups increasingly weaponize legitimate software features—a technique commonly known as "Living off the Trusted Land"—organizations must maintain heightened vigilance against sophisticated supply-chain and application-layer vectors.