China-linked espionage group exploits Sogou Input Method flaw to install GrayRabbit backdoor

A critical remote code execution vulnerability in Tencent's Sogou Input Method for Windows is being actively exploited by the threat group UNC3569. The attack chain uses a crafted custom URI to trigger command-line injection and an outdated Chromium engine, ultimately installing the GrayRabbit backdoor. The malware variant observed is a more mature 64-bit build with expanded commands and encrypted command-and-control communication.

The exploit chain relies on three chained weaknesses rather than a single flaw, beginning with an unvalidated protocol handler that passes attacker-controlled arguments to a legitimate executable. From there, the embedded Chromium 80 webview loads a malicious page, and because the browser lacks sandboxing and key security protections, the exploit achieves code execution. The resulting GrayRabbit variant is a 64-bit build with RC4-encrypted command-and-control traffic and capabilities including reverse shells, file transfer, and reflective plugin loading.

Tencent was notified on April 9 and shipped a fix in version 16.3.0.3498 on April 21, which restricts protocol handler arguments to HTTPS and approved domains. However, the underlying browser engine remains outdated and unsandboxed, leaving residual risk. Given Sogou Input Method's hundreds of millions of installations, primarily in China, the exposure window and potential victim pool were substantial.