A China-linked hacking group exploited a security vulnerability in Sogou Input Method, one of the most widely used Chinese-language input tools on Windows, to gain access to victims’ computers and deploy a remote-access backdoor.
Security firm Gen Digital discovered the attack while investigating an active intrusion attributed to UNC3569, a threat group that Google Threat Intelligence links to China and its cybercrime-for-hire ecosystem.
The vulnerability, tracked as CVE-2026-51990, was patched by Sogou developer Tencent in April 2026. However, researchers warn that the incident highlights a deeper security concern: the application’s embedded browser remains based on an outdated version of Chromium with important security protections disabled.
Sogou Input Method Vulnerability Enabled Remote Code Execution
Sogou Input Method is widely used to type Chinese characters on Windows, Android, and iOS devices.
A 2023 study by the University of Toronto’s Citizen Lab estimated that Sogou had more than 455 million monthly users across its platforms and accounted for roughly 70% of China’s input-method market.
The newly discovered Windows vulnerability allowed attackers to turn a specially crafted link into code execution on a victim’s computer.
Gen said the attack began with a malicious link and ultimately gave the attacker the same privileges available to the logged-in Windows user.
The campaign was attributed to UNC3569, which Google has tracked since 2021. The group has reportedly targeted government, education, technology, and financial organizations, particularly across East and Southeast Asia.
How the Malicious Link Triggered the Attack
The Windows version of Sogou Input Method consists of multiple components that communicate through a custom Windows protocol called sgbiz:.
When Windows encounters an sgbiz: link, it passes the request to a Sogou component called biz_helper.exe.
That component determines which Sogou application should be launched, but Gen discovered that it failed to properly validate the command-line arguments supplied through the link.
This allowed attackers to control those arguments.
The malicious link instructed Sogou to launch SGMyInput.exe, the application’s settings component, and open its skin store using a web address selected by the attacker.
The skin store is significant because it is the part of the application that launches a browser window.
According to Gen, the embedded browser then opened the attacker-controlled website without properly validating the destination.
Outdated Chromium Browser Made the Attack Possible
Sogou does not rely on the system’s regular browser for this functionality. Instead, it ships its own Chromium-based browser engine.
Gen found that the version embedded in the application was Chromium 80, released around March 2020.
More importantly, researchers found security protections disabled within the browser.
The embedded browser had its sandbox disabled, removing an important layer of isolation designed to prevent malicious web content from interacting with the underlying operating system.
Gen also found the browser’s same-origin policy protections disabled, weakening a fundamental browser security mechanism that normally prevents websites from accessing data belonging to other origins.
With the sandbox disabled, an exploit running inside the embedded browser could potentially execute code with the privileges of the logged-in user.
Attackers Exploited a Five-Year-Old Chrome Vulnerability
The malicious website delivered an exploit targeting CVE-2021-38003, a vulnerability in Google’s V8 JavaScript engine.
The flaw involved the handling of JSON.stringify and could allow attackers to corrupt memory and ultimately execute arbitrary code.
Google patched the vulnerability in Chrome 95 in October 2021.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) subsequently added CVE-2021-38003 to its catalog of vulnerabilities known to have been exploited in the wild.
However, the Sogou browser remained based on the much older Chromium 80 codebase and had not received the corresponding security fixes.
Gen’s analysis found that the problem extends beyond this single vulnerability.
Of the 41 Chromium V8 vulnerabilities listed in CISA’s exploited-vulnerability catalog, researchers determined that at least 32 were fixed in Chrome releases newer than the Chromium version included with Sogou.
The researchers noted, however, that this does not mean all 32 vulnerabilities can necessarily be exploited through Sogou’s embedded browser.
Tencent Disputed the Attack Complexity
Gen reported the vulnerability to Tencent on April 9, 2026.
Tencent acknowledged the report the following day and confirmed on April 21 that a fix had been completed.
The company characterized the attack chain as relatively complex and said successful exploitation would require social engineering to convince a user to interact with a browser pop-up prompt.
Modern Chromium-based browsers generally display a confirmation dialog when a webpage attempts to launch an external application through a custom protocol.
Gen, however, said the malicious link could be delivered through email or chat messages, potentially giving attackers an opportunity to persuade users into opening it.
GRAYRABBIT Backdoor Installed on Victims
After successfully exploiting the browser vulnerability, the attackers deployed a small downloader that ultimately installed GRAYRABBIT, a backdoor associated with the UNC3569 group.
According to Google Threat Intelligence, GRAYRABBIT has been used by the group for years and serves as an initial foothold on compromised systems.
The malware provides attackers with capabilities including:
- Remote command execution
- Uploading files to compromised systems
- Downloading files from compromised systems
- Loading additional modules from attacker-controlled infrastructure
Gen observed the downloader retrieving three files from an Alibaba Cloud server hosted in Hong Kong.
The files included:
- A legitimate copy of 7-Zip
- A malicious DLL
- An encrypted payload
The files were written to:
C:\Users\Public\Documents
The malicious DLL was named 7z.dll, allowing it to be loaded when the accompanying 7-Zip executable was launched.
Malware Uses Anti-Analysis Techniques
The malware also employed techniques designed to make automated analysis more difficult.
Before decrypting its payload, the malicious DLL checks the number of processes running on the computer.
If fewer than 50 processes are detected, the malware generates an incorrect decryption key, causing the payload to appear as corrupted data.
This technique can help malware evade automated sandbox environments, which often run significantly fewer processes than a normal user’s computer.
The malware also attempts to remove traces of itself.
Gen observed the malicious DLL moving its contents into an NTFS alternate data stream, a less-visible portion of a Windows file record, before marking the original file for deletion.
GRAYRABBIT Communicates Over Port 443
The final GRAYRABBIT backdoor communicates with its command-and-control infrastructure at:
mail.uaiubifas[.]top
The connection uses TCP port 443, a port normally associated with HTTPS traffic.
However, Gen said the traffic is not actually TLS-encrypted. Instead, the backdoor uses RC4 to obfuscate its communications.
This means defenders may be able to identify suspicious traffic by looking for non-TLS communications occurring over TCP 443.
Tencent’s Patch Blocks the Initial Attack
Tencent addressed the vulnerability in Sogou Input Method version 16.3.0.3498.
The fix was delivered through an automatic update beginning April 21, 2026.
The patch modifies biz_helper.exe, which is responsible for handling the vulnerable sgbiz: protocol.
The updated component now examines arguments containing web addresses and rejects destinations that do not use HTTPS.
It also restricts permitted hostnames to specific domains, including:
sogou.comqq.comwoa.comsogou
Gen said additional checks were also introduced after the initial report.
The Embedded Browser Remains Outdated
Although Tencent blocked the exploitation path, Gen said the underlying embedded browser was not upgraded.
In the patched version analyzed by researchers, the browser was still based on Chromium 80.
The sandbox also remained disabled, while other browser security settings continued to be weakened.
This means the patch prevents attackers from directly controlling the browser destination through the vulnerable protocol handler, but it does not address the broader risks associated with shipping an outdated browser engine.
Gen said the affected components require additional security improvements.
What Users Should Do
Users of Sogou Input Method should ensure that the application has been updated to version 16.3.0.3498 or later.
Organizations should also investigate systems that may have been exposed before the patch was installed, particularly if users opened suspicious links that launched Sogou Input Method.
Gen published the following indicators of compromise:
Indicators of Compromise
- Malicious DLL:
29c7ee41d0cc9e07d981e451df56d0c3d37c41ac4ec10c7b516cc033ee397a63 - Encrypted payload:
749160a2f20f82744026719cf72e483595c6aad718efa74d675a98662e02422 - GRAYRABBIT backdoor:
d7a3c7eb94edc0e020f74c678743d71d61e944634aade4a67a96c3589e828b3a - Command-and-control domain:
mail.uaiubifas[.]top - Exploit-hosting domain:
noht1ng[.]top - Staging IP:
8.218.50[.]207 - File location:
C:\Users\Public\Documents
The malicious loader may no longer be present on disk because it attempts to delete itself. Consequently, the absence of the DLL does not necessarily mean that a system was not compromised.
There is also no indication that installing the Sogou update automatically removes a GRAYRABBIT backdoor that may already be running.
A Warning About Third-Party Browser Components
The Sogou incident demonstrates how applications that include their own web browsers can introduce security risks when those engines are not regularly updated.
In this case, attackers were able to combine a vulnerable custom protocol handler with an outdated Chromium engine and disabled browser security protections to turn a malicious link into a potential system compromise.
While Tencent’s patch closes the specific attack path, organizations should continue monitoring for signs of compromise on systems that may have been targeted before the update.
Users should update Sogou Input Method immediately and treat unexpected links that launch external applications or authentication prompts with caution.
