UNC3569 Exploits Sogou Input Method Flaw in One – Click Backdoor Attack
A China-linked threat group tracked as UNC3569 exploited a vulnerability in the Windows version of Sogou Input Method (CVE-2026-51990) to deliver the GRAYRABBIT backdoor in a one-click attack. The chain begins with a specially crafted sgbiz: link — a custom Windows protocol used by Sogou components. The vulnerable biz_helper.exe handler validated which application was being launched but failed to validate its command-line arguments, allowing attackers to launch Sogou's settings component (SGMyInput.exe) and redirect its built-in browser to an attacker-controlled webpage.
That built-in browser was based on Chromium 80 (released in 2020), shipped with the sandbox and other security protections disabled. The attackers exploited CVE-2021-38003, a V8 JavaScript engine vulnerability that enables arbitrary code execution; because the browser lacked an effective sandbox, successful exploitation ran code with the privileges of the logged-in user. The exploit then downloaded a legitimate copy of 7-Zip, a malicious 7z.dll, and an encrypted payload. The DLL used process-count checks to hinder automated malware analysis before decrypting and executing GRAYRABBIT, which provides remote command execution, file transfer, and the ability to load additional modules.
The backdoor communicated with its command-and-control server over TCP port 443 using RC4-obfuscated traffic rather than TLS. Researchers reported the Sogou vulnerability was fixed in version 16.3.0.3498; however, the outdated Chromium engine and disabled browser security protections reportedly remained unchanged, leaving that underlying weakness in place.
Attack Surface
Endpoint, Web Browser
Tactics
Initial Access, Execution, Persistence, Defense Evasion, Command & Control
Techniques
- T1189 – Drive-by Compromise
- T1059 – Command and Scripting Interpreter
- T1055 – Process Injection
- T1203 – Exploitation for Client Execution
- T1497 – Virtualization/Sandbox Evasion
- T1140 – Deobfuscate/Decode Files or Information
- T1095 – Non-Application Layer Protocol
- T1204.001 – User Execution: Malicious Link
SuperPRO's Threat Countermeasures Procedures
- Update Sogou Input Method to the latest version released by Tencent that patches CVE-2026-51990, as the vulnerability has been fixed in subsequent updates following responsible disclosure.
- Block sgbiz protocol handler registration in Windows via Group Policy or registry modification at HKEY_CLASSES_ROOTsgbiz to prevent external applications from invoking Sogou custom protocol URLs.
- Deploy endpoint detection rules to alert on biz_helper.exe launching SGMyInput.exe with command-line arguments containing both skincenter page parameter and external URL parameters outside sogou.com domains.
- Implement network egress filtering to monitor and restrict outbound connections from SGMyInput.exe and SGWebRender.exe processes to domains outside expected Sogou infrastructure (sogoupyskin, page.sogou, res.sogou).
- Configure email and web gateway solutions to block or quarantine links containing sgbiz:// protocol scheme, particularly those with encoded URL parameters in the param field.
- Enable application control policies to prevent execution of SGMiniBrowserHelperHost1.0.0.8.dll or restrict CEF-based browser components from loading untrusted content in Sogou Input Method installation directories.
- Hunt for historical indicators of compromise by searching process execution logs for SGMyInput.exe spawned by biz_helper.exe with external URL parameters, particularly those associated with UNC3569 infrastructure or GRAYRABBIT backdoor deployment patterns.
