Sogou Input Method Flaw Exploited to Install Backdoor

A vulnerability in Sogou Input Method, a widely used Windows tool for typing Chinese characters, was exploited in live attacks to install a backdoor called GRAYRABBIT, according to research published Thursday by security company Gen Digital. The company linked the activity to UNC3569, a hacking group that Google Threat Intelligence ties to China and places in the country's hacker-for-hire scene. Google has tracked the group since 2021 and says it has targeted government, education, technology, and finance sectors, mostly in East and Southeast Asia. The attack started with a crafted link and ended with the attacker able to do anything the logged-in user could do. Tencent, which owns and develops Sogou, fixed the entry flaw in April 2026.

Sogou Input Method is the most popular Chinese input method in China, with more than 455 million monthly users across Windows, Android and iOS, according to 2023 research by Citizen Lab at the University of Toronto. That research put its share of Chinese input-method users at about 70 percent, and cited market research showing that the United States accounted for more than 3.3 percent of visits to the product's website. The same research previously found encryption flaws in the app that exposed what people typed. The new flaw is in the Windows version, which is not a single program but a set of components that communicate through a custom link type registered as sgbiz:.

When anything opens an sgbiz: link on Windows, the operating system passes it to biz_helper.exe, a component that reads the link and starts the named Sogou component. That handler checks which program the link asks to start, but according to Gen it performs no filtering on the command-line arguments the link can pass along. An attacker used this gap to point SGMyInput.exe, the Sogou settings program, at the skin store with a web address of the attacker's choosing. The skin store is the only screen in that program that opens a browser window, and the code sends that browser to whatever address it is handed, with no check on the address at all.

That browser is where the third problem sits. Sogou builds its own copy of Chromium, the open-source engine behind Google Chrome, and the version it ships is 80, from around March 2020. Gen found two of the browser's protections switched off in the code: the sandbox, which normally keeps a compromised web page away from the rest of the computer, and the same-origin policy, which stops a page from reading data from other sites. With the sandbox gone, a JavaScript flaw in the page becomes code that runs on the user's computer with the user's own privileges, and there is no second step to exit the browser. Gen says clicking the link was all it took. Tencent does not agree. In a response quoted in the research, Tencent described the chain as relatively complex and said an attacker would need social engineering to get the user to 'actively authorize the browser's pop-up prompt.' Browsers built on Chromium do show a confirmation box before handing a link to a separate program on the computer, and a user can tick a box to stop seeing it for a given site. Neither company says what the people in this campaign saw. Gen says the link could also arrive by email or chat message, and neither account says what a user sees when a link is opened that way.

The page the victims were sent to carried an exploit for CVE-2021-38003, a flaw in how V8, Chrome's JavaScript engine, handled JSON.stringify. It let an internal value that scripts should never see escape into the page, and from there an attacker could corrupt memory and run code. Google fixed it in Chrome 95 in October 2021, and CISA added it to its catalog of vulnerabilities known to have been exploited on November 3, 2021. Singapore firm STAR Labs published a full analysis and working exploit code in December 2022. Sogou's Chromium build never received that fix, nor most of the others. Of the 41 Chromium V8 flaws in CISA's catalog, at least 32 were fixed in Chrome releases that came out after the version Sogou ships, according to a check by The Hacker News against each flaw's CVE record. That is a count of flaws, not a count of ways into Sogou. Whether any of them can be reached through the skin store window depends on what the page can touch inside it, and no one has published that work.

The exploit carried a small downloader. Gen traced it pulling three files from a server on Alibaba Cloud in Hong Kong: a legitimate copy of 7-Zip, a malicious DLL, and an encrypted file holding the final payload. All three went into C:\Users\Public\Documents. The malicious DLL was saved under the name 7z.dll, which 7-Zip loads from its own folder at startup, so running 7-Zip loaded the attacker's code instead. The archive command the attackers ran was meaningless; its only job was to start 7-Zip. Before decrypting anything, the DLL counts the processes running on the computer. If it finds fewer than 50, it builds the wrong key and the payload turns to garbage. Automated malware-analysis systems tend to run few processes, while real desktops do not. The DLL then deletes itself by moving its own contents into an NTFS alternate data stream, a hidden part of the file record, and marking the file for deletion, so the file leaves the disk with no delete call in behavior logs. What it leaves behind is GRAYRABBIT, a backdoor that reaches its server at mail.uaiubifas[.]top on port 443. The traffic there is plain TCP scrambled with RC4 rather than TLS. Port 443 typically carries encrypted TLS traffic, so non-TLS traffic on that port is worth watching. GRAYRABBIT provides a remote command shell, allows files to be moved in both directions, and can load additional modules from the attacker's server at any time. Google describes it as the group's first step onto a machine, and it has been used for years.

Gen reported the flaw to Tencent on April 9, 2026, and it is tracked as CVE-2026-51990. Tencent replied the next day and confirmed on April 21 that a fix was complete and would go out to all users via an automatic update in version 16.3.0.3498, twelve days after the report. The whole fix sits in biz_helper.exe. It now looks for the two arguments that carry web addresses, rejects anything that is not HTTPS, and checks the hostname against four allowed endings: sogou.com, qq.com, woa.com and sogou. Gen says more checks were added after that. The browser engine was not touched. In the patched files Gen examined, the sandbox setting is still off, the web security flag is still written into the code, and the same switches are still applied. The engine is still Chromium 80. What has changed is that an outsider can no longer point it at an address of their choosing via the link handler. Gen said those components need more work.

Users should update Sogou Input Method. The fix is in version 16.3.0.3498, which Gen says Tencent pushed to all users by automatic update on April 21, 2026. Two things are missing from the public re