Chinese Hackers Exploit Sogou Input Flaw to Deploy GRAYRABBIT Backdoor
UNC3569 group leveraged a Windows input method vulnerability for remote access.
1Attack Vector Discovery
Gen Digital uncovered UNC3569's exploitation of Sogou Input Method's Windows vulnerability while investigating live intrusions. The China-linked group, active since 2021, used this vector to target government, education, and financial sectors across Asia. The attack chain began with a malicious sgbiz: link that bypassed argument validation, ultimately delivering the GRAYRABBIT backdoor. Tencent patched the flaw in April 2026 but left other vulnerable components unchanged.
2Sogou's Market Dominance
With 455 million monthly users across platforms, Sogou Input Method holds 70% of China's input software market. University of Toronto's Citizen Lab research revealed its international reach, including 3.3% of traffic from the US. The Windows version consists of interconnected components communicating through custom sgbiz: links. This architecture created the vulnerability that UNC3569 exploited through the unsecured skin store browser window.
3Technical Exploit Breakdown
Attackers manipulated SGMyInput.exe to open their chosen URL in Sogou's built-in Chromium 80 browser, which lacked critical security features. The browser had disabled both sandboxing and same-origin policy protections. When victims visited the malicious page, it exploited CVE-2021-38003 in the outdated V8 engine - a vulnerability Google had patched in Chrome 95 back in October 2021 but remained unaddressed in Sogou's implementation.
4Payload Delivery Mechanism
The exploit downloaded three files from an Alibaba Cloud server: legitimate 7-Zip, a malicious DLL, and an encrypted payload. The DLL executed when 7-Zip launched, installing GRAYRABBIT after verifying the system had over 50 processes (bypassing sandboxes). It employed NTFS alternate data streams for stealth before self-deletion. Gen Digital observed the backdoor providing full remote command execution and file transfer capabilities.
5Vulnerability Context
Sogou's Chromium build contained at least 32 unpatched V8 vulnerabilities from CISA's catalog. The Hacker News verified these flaws existed in versions postdating Sogou's implementation. While not all were exploitable through the skin store vector, the outdated components created systemic risks. Tencent disputed the attack's simplicity, claiming social engineering would be needed to bypass browser prompts, though neither company disclosed what victims actually saw.
6GRAYRABBIT Capabilities
Google Threat Intelligence identifies GRAYRABBIT as UNC3569's initial access tool, used since 2021. The lightweight backdoor establishes remote command shells, enables bidirectional file transfers, and can load additional modules on demand. Its process-counting activation check demonstrates sophisticated anti-analysis techniques. The group has consistently targeted East and Southeast Asian entities across multiple sectors with this toolchain.
7Industry Response
CISA had flagged the V8 JSON.stringify vulnerability (CVE-2021-38003) as actively exploited in November 2021. Singapore's STAR Labs published full exploit details in December 2022, yet Sogou never implemented these fixes. The incident highlights risks in third-party component maintenance, especially for widely deployed software like input methods that require deep system integration but often lag in security updates.
8Security Implications
This attack demonstrates how nation-state actors exploit software supply chain weaknesses in ubiquitous tools. The combination of unpatched components, disabled security features, and architectural flaws in Sogou Input Method created a perfect storm. Organizations must monitor not just primary software but supporting utilities and input methods, particularly when they handle sensitive data in targeted sectors like government and finance.