China-Linked UNC3569 Deploys GrayRabbit via Sogou Flaw

Gen Threat Labs has tied a series of GrayRabbit backdoor deployments to UNC3569, a China-based group operating across both the cybercrime and contractor-for-hire space, according to BleepingComputer reporting published September 13.

The access vector is a flaw in Tencent’s Sogou Input Method for Windows. Sogou is one of the most widely used Chinese-language input methods, which gives this attack path a substantial footprint: any organization that allows Sogou on Windows endpoints has exposure. Gen Digital reported the vulnerability to Tencent on April 9, 2026. Tencent patched it in version 16.3.0.3498, released April 21.

The vulnerability chains three problems. First, the application’s URI handler for the sgbiz: scheme passes user-controlled arguments without validation. Second, a Chromium-based browser component embedded in the app navigates to arbitrary URLs without restriction. Third, the underlying engine runs on Chromium 80, outdated and without a sandbox. Gen Digital’s research notes that Tencent’s patch applied URL validation and domain whitelisting to the handler, but the browser component itself remains an old, unsandboxed engine. That means the attack surface is narrowed, not closed, and the long-term risk depends on whether Tencent updates the browser component as well.

GrayRabbit, the payload delivered through this chain, covers standard remote access functions: process execution, interactive reverse shell, file upload and download, system and user enumeration, and in-memory plugin loading. Gen Digital has the full IOC and behavioral detail in their research. The NVD record for the assigned CVE identifier was not yet published at the time of this article.

UNC3569 is the same kind of hybrid operator that has become a recurring story in Chinese threat actor coverage. The group works across financially motivated and state-adjacent targeting, which makes attribution complicated and victim selection harder to predict. The same general pattern showed up in Fire Ant’s Cisco IOS XR campaign, where contractor-style targeting served espionage objectives. The delivery mechanism here is different, but the organizational model is consistent.

For defenders: update Sogou Input Method to version 16.3.0.3498 or later, and inventory whether Sogou is present on endpoints you would not normally expect it on. The combination of active exploitation and an outdated, unsandboxed browser engine embedded in a common utility application is not a scenario that benefits from waiting. Related reporting on malware delivery through compromised or exploited applications: JSCeal’s credential theft via browser session abuse covers a different method against a different target base but illustrates the same general principle of using legitimate software paths for unauthorized access.