Tencent Sogou Input Method Vulnerability (CVE-2026-51990) Exploited to Deploy GrayRabbit Malware in Targeted Attacks

Executive Summary

A sophisticated cyber-espionage campaign has been uncovered in which threat actors exploited a critical vulnerability in the Tencent Sogou Input Method for Windows to deploy the advanced GrayRabbit malware. The vulnerability, tracked as CVE-2026-51990, enables remote code execution (RCE) through the abuse of the proprietary sgbiz: protocol handler and an embedded, outdated Chromium browser engine. The attack chain culminates in the installation of the GrayRabbit backdoor, granting attackers persistent, covert access to compromised systems. This campaign, attributed to the China-linked group UNC3569, has been observed targeting government, education, technology, and finance sectors, predominantly in East and Southeast Asia. The exploitation leverages a blend of social engineering, protocol handler abuse, and browser exploitation, underscoring the evolving complexity of supply chain and application-layer threats. Immediate patching and vigilant monitoring are strongly advised.

Threat Actor Profile

The campaign is attributed to UNC3569, a China-aligned advanced persistent threat (APT) group with a history of targeting strategic sectors for intelligence gathering and cyber-espionage. UNC3569 is known for leveraging zero-day vulnerabilities and sophisticated social engineering to gain initial access. The group’s operations are characterized by the use of custom malware, multi-stage payload delivery, and advanced anti-analysis techniques. Their targeting pattern includes government agencies, educational institutions, technology firms, and financial organizations, with a geographic focus on East and Southeast Asia. UNC3569 has been tracked by multiple threat intelligence vendors, including Google Threat Intelligence, since at least 2021, and is considered highly capable in both offensive tooling and operational security.

Technical Analysis of Malware/TTPs

The attack chain begins with the exploitation of CVE-2026-51990 in the Tencent Sogou Input Method for Windows, specifically versions prior to 16.3.0.3498. The vulnerability arises from the mishandling of the custom sgbiz: URI protocol, which is registered to invoke the biz_helper.exe process. This handler fails to sanitize command-line arguments, allowing attackers to pass arbitrary parameters. When a victim clicks a crafted sgbiz: link—typically delivered via spearphishing emails or instant messages—biz_helper.exe launches an embedded Chromium 80 browser instance with both the sandbox and same-origin policy disabled.

The attacker-controlled web page, loaded in this insecure browser context, exploits CVE-2021-38003, a known vulnerability in the V8 JavaScript engine, to achieve arbitrary code execution within the browser process. This enables the download and execution of a multi-stage payload.

The initial payload consists of a legitimate 7-Zip binary, a malicious DLL named 7z.dll, and an encrypted payload file (p). The malicious DLL is side-loaded by the 7-Zip binary, a classic DLL hijacking technique. The DLL incorporates anti-sandbox logic, only decrypting and executing the next stage if more than 50 processes are running on the host, thereby evading automated analysis environments.

Upon successful execution, the DLL decrypts and loads the GrayRabbit backdoor (core.dll). GrayRabbit is a modular, fileless implant that provides remote shell access, file transfer capabilities, and dynamic module loading. It communicates with command-and-control (C2) infrastructure over RC4-encrypted TCP sessions on port 443, masquerading as legitimate HTTPS traffic but often lacking proper TLS handshakes. The malware employs NTFS alternate data streams for self-deletion and persistence, further complicating detection and forensic analysis.

Key indicators of compromise (IOCs) include the presence of suspicious files in C:\Users\Public\Documents\, anomalous 7-Zip executions, and outbound connections to known malicious domains and IP addresses associated with the campaign.

Exploitation in the Wild

The exploitation of CVE-2026-51990 has been observed in active campaigns since at least mid-2026. Attackers initiate the infection chain by distributing malicious sgbiz: links via spearphishing emails, instant messaging platforms, and potentially through compromised websites. Upon user interaction, the vulnerable protocol handler is triggered, leading to the execution of the exploit chain described above.

The campaign’s infrastructure includes exploit hosting domains such as noht1ng[.]top and C2 domains like mail.uaiubifas[.]top, with backend servers hosted on Alibaba Cloud infrastructure in Hong Kong. The attackers have demonstrated operational agility, rotating infrastructure and payloads to evade detection. The use of legitimate binaries (such as 7-Zip) and encrypted payloads further complicates traditional signature-based detection.

Incident reports indicate that the attackers have successfully compromised multiple organizations in the government, education, technology, and finance sectors. The campaign’s reliance on user interaction for initial access highlights the continued effectiveness of social engineering, even against well-defended targets.

Victimology and Targeting

Analysis of telemetry and open-source intelligence reveals that the primary targets of this campaign are organizations in East and Southeast Asia, with a particular focus on China, Taiwan, Hong Kong, and Singapore. The sectors most affected include government agencies, educational institutions, technology companies, and financial organizations. There is evidence of limited exposure in the United States, with approximately 3.3% of Sogou Input Method website visits originating from US-based IP addresses, suggesting potential collateral exposure or secondary targeting.

The selection of Tencent Sogou Input Method as an attack vector is strategic, given its widespread deployment in the region and its integration into enterprise and government IT environments. The attackers’ use of highly tailored spearphishing lures and their ability to exploit both application-layer and browser vulnerabilities demonstrate a high level of technical sophistication and targeting discipline.

Mitigation and Countermeasures

Organizations are strongly advised to immediately update the Tencent Sogou Input Method for Windows to version 16.3.0.3498 or later, as this release addresses the protocol handler vulnerability. However, it is important to note that the patched version still utilizes an outdated Chromium engine (v80) with the sandbox disabled, which may present residual risk.

Security teams should conduct proactive threat hunting for the following indicators of compromise: the presence of suspicious files in C:\Users\Public\Documents\, anomalous process creation events involving 7-Zip and DLL side-loading, and outbound network connections to the domains mail.uaiubifas[.]top and noht1ng[.]top, as well as the IP address 8.218.50[.]207. Special attention should be paid to RC4-encrypted traffic on port 443 that does not conform to standard TLS protocols.

Endpoint detection and response (EDR) solutions should be configured to alert on DLL side-loading behaviors, the use of NTFS alternate data streams, and the execution of unsigned or suspicious binaries from user-accessible directories. User awareness training should be reinforced to highlight the risks associated with clicking on unsolicited links, particularly those invoking custom protocol handlers.

Given the sophistication of the GrayRabbit malware and the operational security of UNC3569, organizations should assume compromise if indicators are present and initiate comprehensive incident response procedures, including forensic analysis and network containment.

References

About Rescana

Rescana is a leader in third-party risk management (TPRM), providing organizations with a comprehensive platform to continuously monitor, assess, and mitigate cyber risks across their extended supply chain. Our advanced threat intelligence and automation capabilities empower security teams to proactively identify vulnerabilities, respond to emerging threats, and ensure compliance with industry standards. For more information about how Rescana can help safeguard your organization, or for any questions regarding this advisory, please contact us at info@rescana.com.