Affected Systems

Tencent Sogou Input Method for Windows, versions prior to 16.3.0.3498. Hundreds of millions of installations in China. Vulnerability CVE-2026-51990 is a one-click remote code execution flaw exploiting unvalidated URI handler, unrestricted URL navigation, and outdated Chromium 80 engine without sandbox.

Exploitation Status

Actively exploited in the wild by UNC3569 (China-aligned espionage group) to deploy GrayRabbit backdoor malware. Attack chain uses crafted sgbiz: URI links to achieve RCE and malware installation.

Business Impact

Organizations with Sogou Input Method installed face immediate risk of backdoor deployment enabling persistent access, data exfiltration, and lateral movement. GrayRabbit capabilities include reverse shells, file upload/download, system reconnaissance, and in-memory plugin loading. Primary exposure in China-based or Chinese-language environments. Patch available since April 21, 2026, but underlying Chromium engine remains outdated and unsandboxed.

Urgency

🔴 Immediate

Recommended Actions

  • Immediately update Tencent Sogou Input Method to version 16.3.0.3498 or later on all Windows endpoints
  • Hunt for GrayRabbit indicators: monitor for biz_helper.exe and SGMyInput.exe spawning unexpected child processes, outbound connections from Sogou processes, and RC4-encoded C2 traffic
  • Block sgbiz: URI scheme at the perimeter and in email/web gateways to prevent one-click exploitation via malicious links
  • Audit endpoints for Sogou Input Method installations and consider replacing with alternative input methods if not business-critical, given residual risk from outdated Chromium engine
  • Review logs for UNC3569 TTPs including process injection, reflective DLL loading, and connections to known GrayRabbit C2 infrastructure

---

# Threat Actor Context

Actor Profile

UNC3569 is a China-aligned espionage group operating across both cybercrime and cyber contractor-for-hire ecosystems. First publicly documented by Google researchers in 2024 in connection with the GrayRabbit malware family, the group demonstrates sophisticated capabilities in exploiting software vulnerabilities for initial access and deploying modular backdoor frameworks. The actor's targeting and operational patterns suggest espionage objectives aligned with Chinese state interests, though the group's dual positioning in criminal and contractor spaces indicates potential mercenary activity.

TTPs (Tactics, Techniques, Procedures)

UNC3569 employs a multi-stage exploitation chain leveraging CVE-2026-51990, a critical one-click remote code execution vulnerability in Tencent's Sogou Input Method for Windows. The attack begins with Initial Access (T1566 - Phishing) via crafted sgbiz: URI links that trigger command-line argument injection (T1059 - Command and Scripting Interpreter). The group exploits unvalidated protocol handlers and unrestricted URL navigation to force the victim's system to load attacker-controlled web content in an outdated, unsandboxed Chromium 80 browser engine. Exploitation for Client Execution (T1203) achieves code execution and deploys the GrayRabbit backdoor, which provides Command and Control (T1071 - Application Layer Protocol) with RC4-encoded C2 configuration. Post-compromise capabilities include Execution (T1059 - Command and Scripting Interpreter) via reverse shells, Exfiltration (T1041 - Exfiltration Over C2 Channel) through file upload/download, Discovery (T1082 - System Information Discovery), and in-memory plugin loading for persistence and lateral movement.

Targets & Patterns

The campaign specifically targets users of Tencent's Sogou Input Method for Windows, a Chinese character input application with hundreds of millions of installations primarily concentrated in China. This targeting profile suggests the actor focuses on Chinese-speaking populations, likely including government entities, enterprises, and individuals within China's borders or Chinese diaspora communities. The choice of Sogou as an attack vector indicates strategic selection of widely-deployed, trusted software with deep system integration and privileged access. The espionage nature of UNC3569 and the sophistication of the GrayRabbit backdoor suggest targets of intelligence value, potentially including political dissidents, corporate intellectual property holders, government officials, and organizations with strategic or economic significance to Chinese state interests.

Historical Context

GrayRabbit was first documented by Google researchers in 2024 as a modular malware family linked to UNC3569. The variant observed in this 2026 campaign represents a maturation of the malware, featuring a 64-bit architecture, expanded command set, and RC4-encoded C2 configuration—indicating continued development and operational refinement over the two-year period. The evolution from earlier versions to this more sophisticated variant demonstrates sustained investment in the toolset and ongoing operational activity by UNC3569. The group's documented presence in both cybercrime and contractor-for-hire ecosystems since at least 2024 suggests a persistent threat actor with flexible operational models and sustained access to development resources.

Defensive Recommendations

  • Update Tencent Sogou Input Method to version 16.3.0.3498 or later immediately to patch CVE-2026-51990; prioritize deployment across all Windows endpoints with Chinese language input requirements
  • Implement application control policies to block or restrict execution of custom URI protocol handlers (sgbiz:) and monitor for suspicious invocations of biz_helper.exe and SGMyInput.exe with unusual command-line arguments (T1059)
  • Deploy network monitoring to detect connections to known GrayRabbit C2 infrastructure and flag RC4-encrypted traffic patterns; hunt for indicators of compromise including the 64-bit GrayRabbit variant and associated file artifacts
  • Restrict outbound HTTPS connections from input method applications and other productivity software to approved domains only; implement DNS filtering to block access to newly registered or suspicious domains
  • Monitor for reflective DLL loading and in-memory plugin execution (T1620) using EDR solutions; alert on process injection, reverse shell activity (T1059.003), and unusual file upload/download behavior from productivity applications

---

# Geopolitical Context

Geopolitical Context

The exploitation of CVE-2026-51990 in Tencent's Sogou Input Method—a widely deployed Chinese-language input application with hundreds of millions of installations in China—illustrates the complex landscape of China-nexus cyber operations. UNC3569, described by Google researchers as operating across both cybercrime and cyber contractor-for-hire ecosystems, appears to target users of Chinese-language software, potentially including diaspora communities, businesses with China operations, and individuals in Greater China. The targeting of a domestic Chinese platform by a China-aligned group is consistent with patterns observed in state-adjacent operations where threat actors may conduct surveillance or intelligence collection on behalf of state interests while maintaining operational deniability. The deployment of the GrayRabbit backdoor—a modular malware family previously linked to UNC3569—suggests intelligence collection objectives rather than financially motivated cybercrime.

State Actor Alignment

UNC3569 is assessed by researchers to be a China-based threat actor operating in both cybercrime and cyber contractor-for-hire spaces, suggesting potential state-adjacent operations with varying degrees of government oversight or tasking. The group's use of the GrayRabbit malware family, previously documented by Google in 2024, indicates sustained operational capability and infrastructure. While direct state attribution is not established in available reporting, the espionage-focused capabilities of GrayRabbit and the targeting pattern are consistent with intelligence collection operations. The exploitation of a widely used Chinese-language input method may indicate targeting of specific user populations of strategic interest. No formal sanctions or government attribution statements are referenced in available materials.

Business Impacty pro region

The vulnerability's impact extends beyond China's borders to any region with significant populations using Chinese-language input methods, including Taiwan, Hong Kong, Singapore, and Chinese diaspora communities in North America, Europe, and Australia. Organizations conducting business in China or employing Chinese-language speakers may be at elevated risk. The incident underscores supply chain security concerns for widely deployed software from major technology vendors, particularly when applications incorporate outdated components such as unsandboxed browser engines. European entities with China-facing operations or Chinese-speaking personnel should assess their exposure. The exploitation of a Tencent product—one of China's largest technology companies—by a China-aligned group may complicate threat modeling for organizations that distinguish between foreign and domestic threat actors in their risk assessments.

Forecast

If organizations fail to update to Sogou Input Method version 16.3.0.3498 or later, they will remain vulnerable to one-click remote code execution attacks via crafted links. Given that the underlying Chromium engine remains outdated and unsandboxed despite the April 2026 patch, additional vulnerabilities in the browser component are likely to emerge and may be exploited by UNC3569 or other threat actors. If UNC3569 continues operations consistent with its assessed espionage mandate, further targeting of Chinese-language software users across multiple jurisdictions is probable. Organizations in sectors of strategic interest to China-nexus actors—including technology, defense, telecommunications, and government—should anticipate continued exploitation attempts if they deploy affected software. The maturation of the GrayRabbit malware family suggests UNC3569 will likely maintain operational tempo and may expand targeting scope in coming months.