A hacking group with ties to China exploited a security weakness in Sogou Input Method, a widely used tool for typing Chinese characters on Windows, to plant backdoor malware on victims' machines, according to research published Thursday by Gen Digital. The attack started when users clicked a specially crafted link and concluded with attackers gaining the ability to perform any action the logged-in user could execute. Tencent, which owns and maintains Sogou, released a fix in April 2026 after Gen Digital reported the flaw on April 9.

Gen Digital discovered the vulnerability while investigating an active intrusion by UNC3569, a group that Google Threat Intelligence links to China's hacker-for-hire ecosystem. Google has monitored the group since 2021 and reports it has attacked government, education, technology, and finance organizations, primarily across East and Southeast Asia. The backdoor deployed was GRAYRABBIT, a compact program the group has employed for years and that Google characterizes as its initial foothold on a target system. It provides attackers with a remote command shell, enables bidirectional file transfers, and can retrieve additional modules from the attacker's server at any moment. Sogou Input Method reached more than 455 million people monthly across Windows, Android, and iOS as of 2023, according to research from Citizen Lab at the University of Toronto, which also found the app held roughly 70% of the Chinese input-method market. The same research noted that users extend beyond China, with the United States representing over 3.3% of visits to the product's website. Tencent's patch blocked the entry route but did not update the vulnerable browser component, which remains on its 2020 version with the sandbox protection disabled.

The flaw resided in how Sogou's Windows components communicate through a custom link type called sgbiz:. When any program opens an sgbiz: link, Windows hands it to biz_helper.exe, which reads the link and launches the Sogou component it specifies. That handler verifies which program the link requests but performs no validation on the command-line arguments the link supplies. Gen found zero filtering applied to those arguments. The link directed users to SGMyInput.exe, Sogou's settings interface, instructing it to open the skin store with a web address chosen by the attacker. The skin store is the sole screen in that program that launches a browser window, and the code navigates that browser to whatever address it receives without any verification. That browser runs on Chromium version 80, dating to approximately March 2020, with two security protections explicitly disabled in the code: the sandbox, which ordinarily isolates a compromised web page from the rest of the system, and the same-origin policy, which prevents a page from accessing data on other sites. With the sandbox removed, a JavaScript vulnerability in the page becomes code executing on the user's computer with the user's privileges, requiring no additional step to escape the browser. The page victims reached carried an exploit for CVE-2021-38003, a flaw in Chrome's V8 JavaScript engine fixed by Google in October 2021 and added to CISA's catalog of known exploited vulnerabilities on November 3, 2021. Sogou's Chromium build never received that patch. Of the 41 Chromium V8 flaws in CISA's catalog, at least 32 were addressed in Chrome releases that shipped after the version Sogou distributes.

The exploit delivered a small downloader that pulled three files from an Alibaba Cloud server in Hong Kong: a legitimate copy of 7-Zip, a malicious DLL, and an encrypted file containing the final payload, all written to C:\Users\Public\Documents\. The malicious DLL was saved under the name 7-Zip loads from its own directory at startup, causing the attacker's code to execute instead. The DLL counts running processes before decrypting anything; if it detects fewer than 50, it generates an incorrect decryption key, rendering the payload unreadable—a technique designed to evade automated malware-analysis systems, which typically run few processes. It then deletes itself by moving its contents into an NTFS alternate data stream and marking the file for deletion. What remains is GRAYRABBIT, which contacts its server at mail.uaiubifas[.]top on port 443 using plain TCP traffic scrambled with RC4 rather than TLS. Tencent's fix, tracked as CVE-2026-51990 and completed within 12 days, resides entirely in biz_helper.exe, which now validates the two arguments carrying web addresses, rejecting anything that isn't HTTPS and checking the hostname against four permitted endings: sogou.com, qq.com, woa.com, and sogou. The browser engine itself was left untouched—in the patched files Gen examined, the sandbox setting remains disabled, the web security flag is still hardcoded, and the same switches are still applied. Gen Digital pushed the fix to all users via automatic update in version 16.3.0.3498 on April 21, 2026, and advises users to update immediately. Neither company has disclosed which versions were vulnerable or explained how users can verify their installed version, and no source indicates whether installing the patch removes a backdoor already running on a compromised machine. Organizations relying on widely adopted consumer software for business operations face persistent exposure when vendors prioritize feature velocity over foundational security hygiene, particularly when legacy components remain embedded in patched releases.