Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

UNC3569 Sogou Input Method exploitation campaign

Campaign
First reported
Last updated
Happening score
H score 89
2 unique sources, 2 articles

Summary

Hide ▲

UNC3569 is using a crafted sgbiz: link to exploit Tencent’s Sogou Input Method for Windows and deploy the GRAYRABBIT backdoor. Gen Digital says the activity involves CVE-2026-51990, a one-click RCE flaw chained through a protocol handler, an unrestricted webview navigation path, and an outdated Chromium 80 engine running without a sandbox. The research says Tencent received the report on April 9 and released version 16.3.0.3498 on April 21 to validate URL arguments, allow only HTTPS, and restrict navigation to approved Sogou and Tencent domains. Gen Digital also said the sample it analyzed was a more mature 64-bit GrayRabbit variant with an expanded command set and RC4-encoded C2 configuration.

Cases

UNC3569 Exploitation and Remediation of Sogou Input Method on Windows (2)

Related Happenings

Sogou Input Method Windows link-handler code-execution flaw (CVE-2026-51990)

Vulnerability
H score89 First: 11.09.2026 10:14 Last: 11.09.2026 10:14 Sources 1

How related: "We observed this vulnerability actively exploited in the wild by the UNC3569 threat group to deploy the GRAYRABBIT backdoor through a crafted link,"

About this happening: CVE-2026-51990 is a critical one-click RCE in Tencent’s Sogou Input Method for Windows that UNC3569 exploited through a crafted sgbiz: link to load a malicious...

Open Happening

GRAYRABBIT backdoor deployment via Sogou Input Method exploit

Malware Activity
H score89 First: 11.09.2026 10:14 Last: 11.09.2026 10:14 Sources 1

How related: The backdoor it installed is GRAYRABBIT, a small program the group has used for years and that Google describes as its first step onto a machine. It gives an attacker a remote command shell, allows files to be moved in both directions, and can load additional modules from the attacker's server at any time.

About this happening: The GRAYRABBIT backdoor was deployed in a live intrusion against Sogou Input Method users, giving attackers a remote command shell and the ability to stage additional...

Open Happening

Google Chrome V8 out-of-bounds write security flaw (CVE-2026-87491)

Vulnerability
H score36 First: 09.09.2026 12:11 Last: 09.09.2026 12:11 Sources 1

About this happening: CVE-2026-87491 is a Google Chrome V8 vulnerability that can enable remote code execution inside the browser sandbox through a crafted HTML page. Google patched...

Open Happening

Tencent WeChat security update for zero-click call flaw

Security Patch Release
H score16 First: 08.09.2026 14:54 Last: 08.09.2026 14:54 Sources 1

About this happening: WeChat had a zero-click incoming-call flaw that Calif said could be turned into remote command execution and account takeover on iOS and Android. Tencent relea...

Open Happening

Google Chrome V8 type confusion security flaw (CVE-2026-85046)

Vulnerability
H score36 First: 04.09.2026 10:18 Last: 04.09.2026 10:18 Sources 1

About this happening: CVE-2026-85046 is a Google Chrome V8 type-confusion vulnerability that was exploited in the wild before Google shipped fixes in 152.0.7977.82/.83 for Windows a...

Open Happening

Timeline

  3. 11.09.2026 03:00 3 articles · 14d ago

    UNC3569 uses crafted sgbiz: link to deploy GRAYRABBIT

    Technical Analysis Update

    Gen Digital published research on September 11, 2026 describing a China-linked UNC3569 intrusion that used a crafted sgbiz: link against Sogou Input Method on Windows to install the GRAYRABBIT backdoor and execute code with the logged-in user's privileges.

    Show sources
    Open in new tab