A China-linked cyber group, identified as UNC3569, exploited a vulnerability in the Sogou Input Method on Windows to deploy a backdoor on target systems, according to a report by Gen Digital. The Sogou Input Method is a widely used tool for typing Chinese characters, and the flaw was patched by Tencent in April 2026.
Exploitation of Sogou Input Method
The cyber attack commenced with a specially crafted link that allowed attackers to execute commands as the logged-in user. Gen Digital discovered the vulnerability during an investigation of an active breach by UNC3569, a group linked to China and tracked by Google Threat Intelligence since 2021. The attackers primarily targeted sectors such as government, education, technology, and finance, primarily in East and Southeast Asia.
Through this exploit, the attackers installed the GRAYRABBIT backdoor, a long-used tool providing remote command shell capabilities and enabling file transfers. Despite Tencent’s security patch, the underlying cause of the attack remains unaddressed, with the built-in browser engine still running an outdated version of Chromium from 2020.
Mechanism of the Attack
Sogou Input Method’s popularity, with over 455 million monthly users across different platforms according to 2023 research, made it an attractive target. The flaw was found in the Windows version, where components communicate via a custom link type registered as sgbiz:. This oversight allowed attackers to craft links that directed the Sogou settings program to open a browser at a malicious address.
The outdated browser, using Chromium version 80, had its security sandbox disabled. This allowed JavaScript vulnerabilities to be exploited, facilitating code execution with user privileges. Although Tencent described the attack chain as complex, requiring user interaction, Gen Digital asserts that the exploit could still succeed through social engineering.
Vulnerability Details and Countermeasures
The attackers leveraged a 2021 browser vulnerability, CVE-2021-38003, which compromised the V8 JavaScript engine’s handling of JSON.stringify. Despite being fixed in Chrome 95, Sogou’s browser never received this update, leaving it susceptible. Gen Digital’s investigation highlighted that many security updates were missing from the Sogou build.
The attack involved deploying a downloader which retrieved additional malicious files from a server in Hong Kong. The payload included a legitimate 7-Zip copy, a malicious DLL, and an encrypted file. Once executed, the malicious DLL evaded detection by deleting itself and hiding traces in NTFS alternate data streams.
Tencent responded by updating the biz_helper.exe component to restrict web addresses to trusted domains. However, the core browser engine remains unchanged, highlighting the need for further security enhancements.
Recommendations and Future Outlook
Users are advised to update their Sogou Input Method to version 16.3.0.3498, released on April 21, 2026, to mitigate the risk. While the patch addresses the immediate vulnerability, the outdated browser engine poses ongoing risks. Comprehensive updates to the browser component are necessary for enhanced security.
For systems potentially compromised prior to the update, users should check for specific indicators published by Gen Digital. These include traces of the malicious loader and backdoor. As cyber threats evolve, proactive security measures and timely updates remain crucial to safeguarding systems against sophisticated attacks.
