More than 455 million people a month used Sogou Input Method across platforms, according to 2023 Citizen Lab research — a reach that turned a single crafted link into a broadly consequential intrusion chain, security firm Gen Digital said in research published Thursday.
How UNC3569 turned one link into full control
Gen Digital traced the intrusion to UNC3569, a China-linked group Google Threat Intelligence associates with the country's hacker-for-hire scene. The attack began with a specially formed sgbiz: link on Windows. That custom link type is handled by biz_helper.exe, which starts Sogou components named inside the link. In the vulnerable flow the handler validated which program to start but did not filter the command-line arguments it passed along.
The attackers pointed the link at SGMyInput.exe, Sogou's settings program, and instructed it to open the skin store at a web address of the attackers' choosing. The skin store is the only screen in SGMyInput.exe that opens a browser window, and the code sent that browser to any address it was handed without checking the URL.
Gen found two further weaknesses in Sogou's built-in browser: the engine was a custom Chromium build from around March 2020 (Chromium 80), and two key protections were switched off in code — the sandbox and the same-origin policy. With those protections disabled, a malicious page’s JavaScript could run on the user's computer with the logged-in user's privileges.
The exploit and the payload: CVE-2021-38003 and GRAYRABBIT
The exploit delivered to the in-app browser exploited CVE-2021-38003, a V8 (JavaScript engine) flaw in how JSON.stringify handled internal values. Google patched that bug in Chrome 95 in October 2021; CISA added it to its catalog of vulnerabilities known to have been exploited on November 3, 2021; and STAR Labs published an analysis and working exploit in December 2022. Sogou’s Chromium build had not received that fix.
The attack's downloader retrieved three files into C:\Users\Public\Documents: a legitimate copy of 7-Zip, a malicious DLL saved as 7z.dll, and an encrypted payload file named p. The attackers used 7-Zip to load their DLL; that DLL checked the host for at least 50 running processes before decrypting the payload — a simple anti-analysis check — then moved its contents into an NTFS alternate data stream and marked the file for deletion, leaving little on-disk trace of the loader itself.
The final payload was GRAYRABBIT, a compact backdoor UNC3569 has used for years. Gen says GRAYRABBIT provides a remote command shell, bidirectional file transfer and the ability to load additional modules from the attacker's server. In this intrusion the backdoor reached a command server at mail.uaiubifas[.]top on port 443, using plain TCP scrambled with RC4 rather than TLS.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleTencent's April 2026 patch: fixed entry point, not the engine
Gen reported the flaw to Tencent on April 9, 2026; Tencent confirmed a fix and pushed it via automatic update in version 16.3.0.3498 on April 21, 2026. The defect is tracked as CVE-2026-51990. The patch hardens biz_helper.exe: it now rejects non-HTTPS addresses for the two arguments that carry web addresses and limits permitted hostnames to endings including sogou.com, qq.com, woa.com and sogou. Gen says additional checks were added after that.
However, the patched files Gen examined still showed Sogou's embedded browser engine at Chromium 80, with the sandbox setting off and the web security flag written into code the same way. In short: Tencent closed the route via the sgbiz: handler that the attackers used, but it did not update or re-enable the browser protections in the embedded Chromium build that made remote exploitation possible.
Indicators and technical traces to hunt for
- Malicious DLL loader (written to disk as 7z.dll): SHA-256 29c7ee41d0cc9e07d981e451df56d0c3d37c41ac4ec10c7b516cc033ee397a63
- Encrypted payload file (named p): SHA-256 749160a2f20f82744026719cf72e483595c6aad718efa74d675a98662e02422e
- GRAYRABBIT backdoor (internal name core.dll): SHA-256 d7a3c7eb94edc0e020f74c678743d71d61e944634aade4a67a96c3589e828b3a
- Backdoor command server domain: mail.uaiubifas[.]top (port 443)
- Exploit-hosting domain: noht1ng[.]top
- Staging server IP: 8.218.50[.]207 (Alibaba Cloud Hong Kong)
- File path used by the attacker: C:\Users\Public\Documents\
Gen notes the loader deletes itself and that the malicious DLL may no longer be present on disk; the presence of GRAYRABBIT should be the primary concern if a machine may have been reached before the April 21 patch. Gen also highlighted that the backdoor's server used plain RC4-scrambled TCP on port 443, so non‑TLS traffic over port 443 can be an indicator of compromise.
How technologists, enterprises, and end users should act
- Technologists and security teams: verify Sogou Input Method is updated to version 16.3.0.3498, hunt for the listed SHA-256 indicators and anomalous non‑TLS traffic on port 443, and scan for signs of GRAYRABBIT persistence.
- Affected enterprises and procurement leaders: confirm automatic updates were applied and evaluate whether the embedded Chromium 80 engine is acceptable for internally developed or third-party Windows utilities used by employees.
- End users and the general public: update Sogou Input Method to version 16.3.0.3498 and treat unexpected sgbiz: links in email and chat with caution.
The intrusion is a compact reminder of how legacy components and permissive link handlers can be chained into a full compromise: Tencent closed the specific door UNC3569 used, yet the unpatched browser engine and disabled protections that made the exploit possible remain present in the code Gen examined. The immediate next step is straightforward — update to 16.3.0.3498 and hunt for the indicators above — while the longer technical question is whether the embedded engine will receive the broader updates its Chromium ancestry missed.
