Back Ground.News

Hackers exploit Tencent app flaw to deploy GrayRabbit malware

Ground.News • September 13, 2026

Threat actors linked to a China-aligned espionage group are exploiting a critical vulnerability (CVE-2026-51990) in Tencent's Sogou Input Method for Windows to deploy the GrayRabbit backdoor.

Threat actors linked to a China-aligned espionage group are exploiting a critical vulnerability (CVE-2026-51990) in Tencent’s Sogou Input Method for Windows to deploy the GrayRabbit backdoor. Researchers at cybersecurity company Gen Digital warn that the security issue is a one-click remote code execution (RCE) flaw. "We observed this vulnerability actively exploited in the wild by […] Thank you for subscribing to our RSS feed!

100 % of the sources are Center

To view factuality data please Upgrade to Premium

To view ownership data please Upgrade to Vantage

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

China-Aligned Hackers Exploit Tencent's Sogou Flaw for Backdoor Deployment A critical vulnerability (CVE-2026-51990) in Tencent's Sogou Input Method for Windows has been exploited by the China-linked UNC3569 threat group to deploy the GrayRabbit backdoor. The flaw allows for one-click remote code execution via crafted links, affecting hundreds of millions of users. The attack exploits three weaknesses: unvalidated command-line argument injection, unrestricted URLs, and an outdated, unsandboxed Chromium browser engine. Gen Digital reported that the vulnerability has been actively exploited in the wild, with the backdoor enabling attackers to execute commands, upload files, and collect system information. Tencent issued a patch in April 2026, but the underlying browser remains outdated and insecure. The Dutch NCSC has warned of imminent exploitation of this vulnerability, emphasizing the urgency for organizations to monitor for indicators of compromise. The attack primarily targets government and defense sectors. 13 sources 78

Extracted Entities

Hackers exploit Tencent app flaw to deploy GrayRabbit malware

The full story

Extracted Entities

Attack Types (1)

Countries (1)

CVEs (1)

Malware (1)

Platforms (2)