A Three-Stage Chain Hiding in a Custom URI Handler
Security researchers at Gen Digital have detailed how a China-based threat group tracked as UNC3569 exploited a now-patched vulnerability — CVE-2026-51990 — in Tencent's Sogou Input Method for Windows to deploy a backdoor called GrayRabbit. Gen found the flaw while investigating a live intrusion, and the bug chain is a reminder that "input method editors" (IMEs), widely installed across East Asian markets, carry the same attack surface as any other software with a custom URI handler and an embedded browser engine.
How the Exploit Chain Works
The attack requires just one click on a crafted link and strings together three separate weaknesses:
- Unvalidated argument injection in the
sgbiz:custom URI scheme, handled bybiz_helper.exe. The handler checks which Sogou component to launch, but not the arguments passed along with it. - Unrestricted URL navigation inside a CEF-based webview component (Sogou's "skincenter").
- That webview runs on an outdated, unsandboxed Chromium 80 engine.
Put together: a victim clicks a malicious sgbiz: link → Windows hands it off to Sogou's URI handler → an attacker-controlled URL loads inside the unsandboxed webview → code executes with the logged-in user's privileges.
The GrayRabbit Backdoor
Google Threat Intelligence describes GrayRabbit (GRAYRABBIT) as UNC3569's long-standing first-stage implant. Once dropped, it provides:
- An interactive reverse shell and remote process execution
- Bidirectional file transfer
- Host reconnaissance (system and user information gathering)
- Reflective, in-memory plugin loading
- RC4-obfuscated command-and-control traffic, disguised as TLS on port 443 (a useful detection signal, since it isn't real TLS)
Observed indicators include a C2 domain of mail.uaiubifas[.]top on port 443.
Who's Behind It
UNC3569 is a group Google has tracked since 2021, describing it as operating "across both the cybercrime and cyber contractor-for-hire ecosystems" — part of China's broader hacker-for-hire landscape. Historical targeting spans government, education, technology, and finance organizations across East and Southeast Asia.
Patch Status
Gen Digital reported the flaw to Tencent on April 9, 2026; Tencent confirmed a fix on April 21 — a 12-day turnaround. The patch shipped via Sogou's auto-update mechanism in version 16.3.0.3498, adding URL argument validation, enforcing HTTPS-only navigation, and allow-listing trusted hostnames (sogou.com, qq.com, woa.com, and related Sogou domains).
Notably, the fix addresses the URI-handler and navigation-restriction layers but does not touch the underlying unsandboxed Chromium 80 engine — the sandbox flag reportedly remains off, leaving that specific hardening gap unresolved even in patched builds.
Why It Matters
The Sogou IME chain fits a pattern security researchers have flagged repeatedly: bundled, auto-updating consumer software with custom protocol handlers and embedded browser components is a durable initial-access vector, especially in regions where a given IME or utility app has near-universal install rates. Organizations with Windows endpoints running Sogou Input Method should confirm they're on version 16.3.0.3498 or later and treat any historical sgbiz: link-click activity in logs as worth investigating.