Bleepingcomputer China-Aligned Hackers Exploit Tencent's Sogou Flaw for Backdoor Deployment
Article Content
- •CVE-2026-51990 exploited by UNC3569 to deploy GrayRabbit backdoor.
- •Vulnerability allows one-click remote code execution via crafted links.
- •Tencent issued a patch in April 2026, but underlying security issues remain.
A critical vulnerability (CVE-2026-51990) in Tencent's Sogou Input Method for Windows has been exploited by the China-linked UNC3569 threat group to deploy the GrayRabbit backdoor. The flaw allows for one-click remote code execution via crafted links, affecting hundreds of millions of users. The attack exploits three weaknesses: unvalidated command-line argument injection, unrestricted URLs, and an outdated, unsandboxed Chromium browser engine. Gen Digital reported that the vulnerability has been actively exploited in the wild, with the backdoor enabling attackers to execute commands, upload files, and collect system information. Tencent issued a patch in April 2026, but the underlying browser remains outdated and insecure. The Dutch NCSC has warned of imminent exploitation of this vulnerability, emphasizing the urgency for organizations to monitor for indicators of compromise. The attack primarily targets government and defense sectors.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (14)
Following this threat?
Track UNC3569, Grayrabbit and Gen Digital in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
SlippyNunchucks Exploits Sogou Input Method to Distribute DarkVigil Malware ESET has reported that the SlippyNunchucks APT group is using a DNS hijacking operation to distribute DarkVigil malware through the Sogou Input Method, a popular Chinese input application. The attack exploits a vulnerability in the application’s branded vocabulary promotion mechanism, allowing the threat actor to… 
Critical RCE Vulnerability in Prefab UI Disclosed A critical remote code execution vulnerability, CVE-2026-120338, was disclosed on November 1, 2026, affecting Prefab UI's Generative UI sandbox. The flaw allows attackers to execute arbitrary Python code by exploiting Deno's permissions, enabling file read/write access on the host server. This vulnerability affects…