Actor Profile

UNC3569 is a China-linked threat actor attributed by Google Threat Intelligence to the country's hacker-for-hire ecosystem. Active since at least 2021, the group targets government, education, technology, and finance sectors primarily in East and Southeast Asia. UNC3569 is motivated by espionage objectives and demonstrates sophisticated understanding of software vulnerabilities in widely-deployed applications. The group has consistently deployed GRAYRABBIT as its initial-access backdoor across multiple campaigns.

TTPs (Tactics, Techniques, Procedures)

UNC3569 exploited CVE-2021-38003, a V8 JavaScript engine vulnerability in an outdated Chromium build (version 80, circa March 2020) embedded within Sogou Input Method. The attack chain leveraged a crafted sgbiz: custom URI scheme link that bypassed argument validation in biz_helper.exe, directing victims to a malicious skin store page. The exploit succeeded due to disabled browser sandbox and same-origin policy protections. Initial access was achieved through social engineering via crafted links delivered through unknown vectors (likely email or chat). The group employed DLL side-loading using a legitimate 7-Zip binary to execute GRAYRABBIT, which provides remote command shell access, bidirectional file transfer, and modular payload loading capabilities. Anti-analysis techniques included process-count checks (requiring 50+ processes) to evade automated sandboxes. Relevant MITRE ATT&CK techniques: T1566 (Phishing), T1204.001 (User Execution: Malicious Link), T1203 (Exploitation for Client Execution), T1574.002 (DLL Side-Loading), T1140 (Deobfuscate/Decode Files or Information), T1027 (Obfuscated Files or Information), T1059.003 (Command and Scripting Interpreter: Windows Command Shell).

Targets & Patterns

UNC3569 targets government, education, technology, and finance sectors with geographic focus on East and Southeast Asia. In this campaign, the technology sector was specifically targeted. The selection of Sogou Input Method as an attack vector is strategically significant: the application has over 455 million monthly users (approximately 70% of Chinese input-method users) across Windows, Android, and iOS platforms, with substantial user bases in China and over 3.3% of website visits originating from the United States. This targeting pattern suggests the actor seeks broad access to Chinese-speaking populations in technology and government roles, likely for espionage and intelligence collection. The choice of a widely-trusted productivity tool demonstrates sophisticated supply-chain-adjacent thinking, exploiting software that users interact with constantly and trust implicitly.

Historical Context

Google Threat Intelligence has tracked UNC3569 since 2021, identifying the group as part of China's hacker-for-hire ecosystem. GRAYRABBIT has been used by the group for years as its standard first-stage backdoor, indicating operational consistency and a mature toolset. The CVE-2021-38003 vulnerability exploited in this campaign was patched by Google in Chrome 95 (October 2021) and added to CISA's Known Exploited Vulnerabilities catalog on November 3, 2021. STAR Labs published full analysis and working exploit code in December 2022, suggesting UNC3569 leveraged publicly available research. The vulnerability remained exploitable in Sogou's outdated Chromium 80 build until Tencent's April 2026 patch. Gen Digital identified at least 32 additional CISA-cataloged Chromium V8 vulnerabilities present in the unpatched Sogou version, indicating a long-standing security debt that may have enabled previous campaigns.

Defensive Recommendations

  • Monitor for suspicious sgbiz: custom URI scheme invocations and validate command-line arguments passed to registered protocol handlers, particularly those launching browser components (T1204.001)
  • Detect DLL side-loading attempts by monitoring for legitimate binaries (e.g., 7-Zip, 7z.exe) loading DLLs from unusual directories like C:\Users\Public\Documents (T1574.002)
  • Implement application allowlisting and ensure input method editors and productivity software are updated to current versions; prioritize patching CVE-2021-38003 and other CISA KEV-listed Chromium vulnerabilities
  • Deploy behavioral detection for processes performing anti-sandbox checks such as process enumeration followed by conditional decryption or execution (T1027, T1497.001)
  • Establish network monitoring for outbound connections from input method software and productivity tools to cloud infrastructure (Alibaba Cloud, AWS, Azure) that deviate from expected update/telemetry patterns, particularly connections to Hong Kong-based infrastructure

---

# Geopolitical Context

Geopolitical Context

The exploitation of Sogou Input Method—a tool with over 455 million monthly users, approximately 70% of the Chinese input-method market—represents a significant supply-chain risk vector targeting Chinese-language users globally. UNC3569, which Google Threat Intelligence assesses as part of China's hacker-for-hire ecosystem, has conducted operations since at least 2021 targeting government, education, technology, and finance sectors primarily in East and Southeast Asia. The group's use of GRAYRABBIT as an initial-access backdoor is consistent with persistent espionage tradecraft. The vulnerability chain exploited CVE-2021-38003, a V8 engine flaw patched by Google in October 2021 but never integrated into Sogou's embedded Chromium 80 build from March 2020. Tencent's April 2026 patch addressed the specific attack vector but left the outdated browser engine and disabled security features intact, suggesting incomplete remediation. The incident highlights systemic challenges in software supply-chain security within China's technology sector, where widely deployed applications may embed legacy components with known vulnerabilities. The attacker's use of Alibaba Cloud infrastructure in Hong Kong and anti-analysis techniques (process-count checks to evade sandboxes) demonstrates operational sophistication consistent with state-aligned or state-tolerated threat actors.

State Actor Alignment

UNC3569 is attributed by Google Threat Intelligence to China and assessed as operating within the country's hacker-for-hire landscape. This positioning suggests the group may conduct operations on behalf of state interests or private clients, a model that provides plausible deniability while advancing strategic intelligence-collection objectives. The targeting of government, education, technology, and finance sectors aligns with Chinese state priorities for economic espionage and strategic intelligence gathering in the Asia-Pacific region. No formal sanctions or public attribution statements from Western governments regarding UNC3569 have been reported in the available data. The group's sustained operations since 2021 and use of infrastructure within Chinese cloud providers (Alibaba Cloud Hong Kong) is consistent with threat actors operating with at least tacit tolerance from Chinese authorities.

Business Impacty pro region

The compromise vector poses acute risk to Chinese-language users across East and Southeast Asia, where Sogou Input Method maintains dominant market share. Citizen Lab research indicates that over 3.3% of traffic to Sogou's website originates from the United States, suggesting a diaspora user base that extends the attack surface beyond Asia. The technology sector is particularly exposed, as the vulnerability chain required only user interaction with a crafted link—deliverable via email, messaging platforms, or watering-hole attacks. For European entities with operations or partnerships in Asia, the incident underscores third-party risk from widely deployed software that may embed unpatched components. The presence of at least 32 additional unpatched Chromium V8 vulnerabilities from CISA's Known Exploited Vulnerabilities catalog in Sogou's codebase suggests the application remains a viable exploitation target for multiple threat actors. Regional CERT organizations and multinational corporations should assess exposure among employees using Chinese-language input methods and consider application-control policies or migration to alternatives with stronger security postures.

Forecast

If Tencent does not modernize Sogou's embedded browser engine and re-enable sandbox protections, the application will likely remain an attractive target for multiple threat actors capable of weaponizing publicly documented Chromium exploits. Should UNC3569 or similar groups shift to exploiting any of the 32+ additional unpatched V8 vulnerabilities identified in Sogou's codebase, defenders may face renewed intrusion campaigns with minimal warning, as exploit code for many CISA-cataloged flaws is publicly available. If Western governments increase scrutiny of Chinese software supply chains in response to this or similar incidents, technology vendors in China may face pressure to accelerate patch cycles and adopt transparent security-development practices, though enforcement mechanisms remain limited. Organizations that continue to permit Sogou Input Method on managed endpoints should anticipate elevated risk of initial access by China-nexus threat actors and may consider network segmentation, enhanced endpoint detection, or migration to input methods with active security maintenance. If UNC3569 expands operations beyond Asia-Pacific, targeting of Chinese-speaking populations in North America and Europe could increase, particularly in technology and research sectors with access to sensitive intellectual property or government contracts.