How the exploit chain works: three linked weaknesses
Gen Threat Labs, part of cybersecurity company Gen Digital, traced the attack to a chained sequence of flaws inside Sogou Input Method. The researchers described the chain as a one-click remote code execution (RCE) that begins when a victim clicks a specially crafted sgbiz: custom URI. That action invokes Sogou’s biz_helper.exe protocol handler, which passes attacker-controlled command-line arguments to the legitimate SGMyInput.exe executable without validating them.
The injected arguments open the application’s skincenter component and instruct an embedded Chromium webview to load an attacker-controlled URL. Gen Threat Labs identified the three specific weaknesses the UNC3569 threat group chains together: an unvalidated command-line argument injection in the sgbiz: URI; an unrestricted URL navigation in a CEF-based webview; and an outdated, unsandboxed Chromium browser engine. Because Sogou does not restrict the URL’s scheme or destination, the webview can be pointed at a malicious page that then targets the embedded Chromium engine.
Sogou Input Method components the attackers leverage
Sogou Input Method is a Windows application that lets users type Chinese characters using a standard keyboard. It includes a custom link handler and a built-in web browser based on Chromium. Gen Threat Labs notes Sogou’s embedded Chromium is substantially out of date — specifically Chromium 80 — and runs without a sandbox and with many web-security protections disabled. That configuration turns a single successful browser exploit into local code execution.
According to the researchers, the exploit sequence culminates when a malicious page takes advantage of a known vulnerability in the embedded Chromium 80 engine; without sandboxing and with protections disabled, the exploit achieves code execution and installs the GrayRabbit backdoor.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageUNC3569 and the GrayRabbit payload
Gen Threat Labs attributes the in-the-wild exploitation to UNC3569, a group previously linked to the GrayRabbit malware family. “We observed this vulnerability actively exploited in the wild by the UNC3569 threat group to deploy the GRAYRABBIT backdoor through a crafted link,” Gen Threat Labs wrote.
The malware sample analyzed by Gen Threat Labs is a more mature 64-bit variant of GrayRabbit with an expanded command set and an RC4-encoded command-and-control (C2) configuration. The backdoor’s capabilities include process execution, opening interactive reverse shells, uploading and downloading files, collecting system and user information, and reflectively loading plugins in the host’s memory.
Tencent’s patch and the remaining technical risk
Gen Threat Labs reported the findings to Tencent on April 9. Tencent released a fix in Sogou Input Method version 16.3.0.3498 on April 21. The patch validates the URL arguments accepted through the protocol handler, permits only HTTPS, and restricts navigation to approved domains related to Sogou and Tencent.
But the researchers warned that the underlying embedded browser remains outdated and continues to run without a sandbox and with many web-security protections disabled. In other words, the April 21 remediation closes the protocol-handler vector and limits which URLs the webview will load, yet the risky configuration of the embedded Chromium engine remains a practical attack surface if other vectors or bypasses are found.
What this means for technologists, enterprises, and end users
- Technologists and security teams: validate that affected systems have Sogou Input Method updated to version 16.3.0.3498, and treat the embedded Chromium engine as a residual risk until Tencent updates and hardens the browser component. The chained nature of the attack underscores how protocol handlers plus embedded webviews can convert a single click into code execution.
- Affected enterprises and procurement leaders: where Sogou Input Method is deployed at scale — the software reportedly has hundreds of millions of installations in China — review software inventory and update policies to ensure installs are patched. Confirm whether custom applications rely on Sogou components and assess exposure to unsandboxed browser engines.
- End users: avoid clicking unexpected or untrusted sgbiz: links and apply the April 21 update. Even with the protocol-handler checks added, an outdated, unsandboxed embedded browser creates remaining risk should a subsequent bypass be found.
Gen Threat Labs’ findings close one door and leave another ajar: Tencent’s validation of protocol-handler arguments and domain restrictions reduces the immediate lure of a crafted link, but the persistent use of an out-of-date, unsandboxed Chromium engine preserves a path to full compromise if future flaws are discovered or different vectors are used. The precise next step the record leaves visible is straightforward — an updated, sandboxed, and fully patched embedded browser — and the industry will be watching whether Tencent takes it.
