UNC3569 Exploitation and Remediation of Sogou Input Method on Windows

Attackers used a crafted **sgbiz:** link to exploit **Sogou Input Method on Windows**, turning a link click into code execution with the logged-in user's privileges and installing the **GRAYRABBIT** backdoor. The activity was tied to **UNC3569** and to **CVE-2026-51990**, a flaw in the product's link-handler path. In the observed intrusion, the attack page also carried an exploit for **CVE-2021-38003** in the Chromium-based browser path used by the application. The exploit chain ran through **biz_helper.exe** and **SGMyInput.exe**, where attacker-controlled link arguments could bypass validation and open a browser to an attacker-chosen address. That browser stage was then used to deliver code that staged additional files on the victim machine and gave the operator the same privileges as the signed-in user. Available material ties the broader operation to targeting in government, education, technology, and finance sectors, mostly in East and Southeast Asia, but it does not identify a confirmed victim count for this intrusion. The flaw was reported to **Tencent** on April 9, 2026, and the vendor confirmed on April 21 that a fix had been completed in **version 16.3.0.3498** and would be delivered through automatic update. The published fix closed the exposed link-handler entry point, but the available material does not define the full affected-version range and notes that broader browser-engine protections in the product were left unchanged. The immediate defensive priority is to verify that **Sogou Input Method** on Windows has updated to **16.3.0.3498** and to watch for **sgbiz:**-initiated browser launches and **GRAYRABBIT** follow-on activity on potentially exposed hosts.