A China-linked group exploited a flaw in Sogou Input Method, a Chinese typing tool used by hundreds of millions, to install a backdoor on Windows machines, Gen Digital reported.
The group, tracked by Google Threat Intelligence as UNC3569, has operated since at least 2021 and is tied to China’s hacker-for-hire scene. Its victims sit in government, education, technology and finance, largely across East and Southeast Asia.
Sogou is really a bundle of components that communicate through a proprietary sgbiz: link format. Clicking one routes through biz_helper.exe, which launches whatever Sogou component the link specifies. The handler validated the target program but ignored the arguments attached to it. That gap let an attacker redirect the settings program to any skin store page.
That page opened inside Sogou’s own Chromium build, version 80 from March 2020, shipped with its sandbox and same-origin policy switched off in code. Embedded in it was an exploit for CVE-2021-38003, a V8 flaw Google closed in Chrome 95 in October 2021. The fix never made it into Sogou’s engine.
The payload dropped a tampered 7-Zip that loaded a malicious DLL, then delivered GRAYRABBIT, a compact backdoor giving remote shell access and module loading.
Tencent patched the link handler in April under CVE-2026-51990, but left the ancient browser engine and its disabled protections in place.
