Cyber Espionage Group Exploits Tencent App Vulnerability

Threat actors associated with a China-aligned espionage group are taking advantage of a significant vulnerability in Tencent's Sogou Input Method for Windows, identified as CVE-2026-51990, to deploy the GrayRabbit backdoor. This information comes from researchers at cybersecurity firm Gen Digital, who have labeled the security issue as a one-click remote code execution (RCE) flaw.

Gen Threat Labs reported that the vulnerability has been actively exploited in the wild by the UNC3569 threat group, which deploys the GrayRabbit backdoor through a specially crafted link. Sogou Input Method is a widely used application in China, allowing users to type Chinese characters using a standard keyboard. It also includes a custom link handler and a built-in web browser that relies on an outdated version of the Chromium engine.

The attack begins when a victim clicks on a crafted sgbiz: custom URI. This action triggers Windows to invoke Sogou's biz_helper.exe protocol handler, which passes attacker-controlled command-line arguments to the legitimate SGMyInput.exe executable without proper validation. The injected arguments then open Sogou's skincenter component and direct its embedded Chromium webview to load a malicious URL, as Sogou does not impose restrictions on the URL's scheme or destination.

In the final stage of the attack, a malicious webpage exploits a known vulnerability in Sogou's outdated Chromium 80 engine. Since the browser operates without a sandbox and has critical web security protections disabled, the exploit successfully executes code and installs the GrayRabbit backdoor.

Understanding the GrayRabbit Malware Family

In 2024, Google researchers characterized GrayRabbit as a modular malware family, linking it to the UNC3569 threat actor, which operates within both cybercrime and cyber contractor-for-hire ecosystems. The malware sample analyzed by Gen Threat Labs is a more advanced 64-bit variant featuring an expanded command set and RC4-encoded command-and-control configuration.

Case Closed

GrayRabbit's capabilities include executing processes, opening interactive reverse shells, uploading and downloading files, collecting system and user information, and reflectively loading plugins into the host's memory. Gen Threat Labs communicated their findings to Tencent on April 9, leading to the release of a fix in Sogou Input Method version 16.3.0.3498 on April 21. This patch validates the URL arguments accepted through the protocol handler, allowing only HTTPS and restricting navigation to approved domains associated with Sogou and Tencent.

Despite the patch, researchers have cautioned that the underlying browser remains outdated and continues to run without a sandbox, leaving many web security protections disabled.