Bleepingcomputer China-Aligned Hackers Exploit Tencent's Sogou Flaw for Backdoor Deployment
Article Content
- •CVE-2026-51990 exploited by UNC3569 to deploy GrayRabbit backdoor.
- •Vulnerability allows one-click remote code execution via crafted links.
- •Tencent issued a patch in April 2026, but underlying security issues remain.
A critical vulnerability (CVE-2026-51990) in Tencent's Sogou Input Method for Windows has been exploited by the China-linked UNC3569 threat group to deploy the GrayRabbit backdoor. The flaw allows for one-click remote code execution via crafted links, affecting hundreds of millions of users. The attack exploits three weaknesses: unvalidated command-line argument injection, unrestricted URLs, and an outdated, unsandboxed Chromium browser engine. Gen Digital reported that the vulnerability has been actively exploited in the wild, with the backdoor enabling attackers to execute commands, upload files, and collect system information. Tencent issued a patch in April 2026, but the underlying browser remains outdated and insecure. The Dutch NCSC has warned of imminent exploitation of this vulnerability, emphasizing the urgency for organizations to monitor for indicators of compromise. The attack primarily targets government and defense sectors.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (14)
Following this threat?
Track UNC3569, Grayrabbit and Gen Digital in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
Critical BeyondTrust 9.3 Vulnerability Actively Exploited by Threat Actor A critical vulnerability (CVE-2026-102764) in BeyondTrust Remote Support has been discovered and is actively being exploited by the threat group ARMORY CASTLE, reportedly linked to China. The vulnerability, which has a CVSS score of 9.3, allows unauthenticated attackers to upload files and potentially compromise host…