China-linked UNC3569 Exploits Sogou Input Method Flaw to Deploy GrayRabbit Malware

• •UNC3569 exploited a critical vulnerability in Sogou Input Method to deploy GrayRabbit malware.
• •The attack utilizes a crafted link for remote code execution via unvalidated command-line arguments.
• •Tencent patched the vulnerability, but the underlying browser remains outdated and unsandboxed.

A China-linked hacking group, UNC3569, exploited a critical vulnerability (CVE-2026-51990) in Tencent's Sogou Input Method for Windows to deploy the GrayRabbit backdoor. The attack involved a crafted link that allowed remote code execution, enabling attackers to control the victim's machine. Sogou Input Method is widely used in China, with hundreds of millions of installations. The vulnerability was reported by Gen Digital, which noted that the flaw involves unvalidated command-line arguments and an outdated Chromium browser engine. Tencent released a patch on April 21, 2026, but the underlying browser remains outdated and unsandboxed. The attack chain leverages multiple weaknesses in the application, making it a significant threat to users. The backdoor, GrayRabbit, has been linked to espionage activities and has capabilities for extensive control over infected systems. As of now, the exploit is confirmed to be actively exploited in the wild.