China-Linked UNC3569 Exploited Sogou Input Method Flaw to Deploy GRAYRABBIT Backdoor

1. Executive summary

A China-linked actor tracked as UNC3569 exploited an unpatched design flaw in the Windows version of Sogou Input Method — the dominant Chinese-language input tool, with a user base exceeding 455 million monthly across platforms — to deploy the GRAYRABBIT backdoor, giving the attacker a remote command shell, bidirectional file transfer, and modular loading capability at the logged-in user's privilege level. Tencent shipped a fix in April 2026, but per Gen Digital's examination of the patched build, the underlying weakness remains: the embedded Chromium engine is still version 80 (circa March 2020) with the sandbox and same-origin policy still disabled in code. Attribution to UNC3569 rests on Gen Digital's investigation and Google Threat Intelligence's China-based, hacker-for-hire characterisation; UNC3569 has no MITRE ATT&CK profile, so treat the attribution as unconfirmed. Direct risk to EMEA financial services is limited but non-zero: the attack requires a user with Sogou Input Method installed on Windows to click a crafted sgbiz: link, and Google assesses the group has historically targeted the finance sector, though mostly in East and Southeast Asia.

2. Regulatory framing

No NIS2 or UK NIS article is directly engaged by the specific facts of this item.

3. Technical analysis & attack chain

Confirmed attack chain (per Gen Digital's research)

1. Delivery. The victim receives a crafted link — Gen states the link could arrive by email or chat message. The link uses Sogou's custom Windows URI scheme, sgbiz:.
2. Handler invocation. Windows passes any sgbiz: link to biz_helper.exe, which reads the link and launches the Sogou component named in it. The handler validates which program the link requests but performs no filtering whatsoever on the command-line arguments the link instructs it to pass.
3. Argument injection. The attacker-controlled arguments point at SGMyInput.exe (Sogou's settings program) and direct it to open the skin store with an attacker-chosen web address.
4. Unvalidated navigation. The skin store is the only screen in SGMyInput.exe that opens a browser window, and its code navigates to whatever URL it is handed with no validation.
5. Browser exploitation. The embedded browser is Sogou's own Chromium build, version 80 (circa March 2020). Two protections are disabled and hard-coded that way: the sandbox and same-origin policy. With the sandbox absent, a JavaScript flaw in the delivered page executes directly on the host at the logged-in user's privileges — there is no sandbox-escape step.
6. Payload. GRAYRABBIT backdoor is installed. Per Google Threat Intelligence, this is the group's long-standing first-stage implant, providing: a remote command shell, bidirectional file transfer, and the ability to load additional modules from the attacker's server on demand.

Key technical specifics

• Component: Sogou Input Method, Windows build. Not a monolithic program — a component set communicating via the registered sgbiz: URI scheme.
• Exploited handler: biz_helper.exe — argument injection via unvalidated command-line parameters in the sgbiz: link.
• Target component: SGMyInput.exe — skin-store browser window navigates to an arbitrary URL.
• Embedded engine: Sogou-built Chromium 80 (~March 2020), sandbox disabled, same-origin policy disabled, both hard-coded in the application.
• Resulting privilege: Attacker operates with the full rights of the logged-in user. No privilege-escalation step is described in the source.
• Patch status: Tencent fixed the entry path in April 2026, but per Gen Digital's examination of the patched build, the embedded browser remains Chromium 80 with sandbox and same-origin policy still disabled. The structural weakness persists.
• Scale: Citizen Lab (University of Toronto, 2023) research puts Sogou at 455M+ monthly users across Windows/Android/iOS, ~70% share of Chinese input-method users, with the US accounting for over 3.3% of website visits — confirming the installed base is not confined to China.

Disputed and unconfirmed elements — treat with caution

• User-interaction requirement is contested. Gen Digital states clicking the link was sufficient. Tencent disputes this, characterising the chain as "relatively complex" and claiming an attacker would need social engineering to get the user to "actively authorize the browser's pop-up prompt." Chromium-based browsers do display a confirmation dialog before handing a link to an external protocol handler, and users can suppress it per-site. Neither company states what the actual campaign victims saw, and neither account describes what a user sees when the link arrives via email or chat. The true click-through friction is therefore unresolved.
• Attribution is unconfirmed. UNC3569 has no MITRE ATT&CK profile. The China nexus and hacker-for-hire characterisation come solely from Google Threat Intelligence, and the intrusion discovery from Gen Digital. Single-sourced attribution; verify before enforcement action.
• No CVE identifier, CVSS score, or CISA KEV entry is present in the verified reference data or the source material for this flaw. Do not treat this as a CVE-tracked vulnerability; it is a design flaw in a proprietary component chain.
• The source does not describe C2 infrastructure, persistence mechanism, lateral movement, or exfiltration behaviour for GRAYRABBIT in this campaign. No detail on those stages should be assumed.

4. Mitigation & containment

P1 — within 24 hours

• Identify Sogou Input Method in the Windows estate. Query software inventory for the application and for the specific binaries biz_helper.exe and SGMyInput.exe. Any hit in a financial-services environment warrants investigation given the group's assessed finance-sector interest.
• Block the sgbiz: protocol handler at the endpoint. If application control (AppLocker/WDAC or EDR equivalent) is deployed, block biz_helper.exe from being invoked via protocol handler, or remove the sgbiz: URI scheme registration (under HKEY_CLASSES_ROOT\sgbiz) on machines where Sogou is not a business requirement.
• Hunt for GRAYRABBIT. Search for outbound connections and process behaviour consistent with a remote shell / file-transfer implant on any host with Sogou installed. Gen's research stems from a live intrusion — assume the campaign is operational.

P2 — within 72 hours

• Force-remove or restrict Sogou Input Method on all corporate Windows endpoints unless there is a documented business need. Where the need exists, confirm the vendor fix from April 2026 is applied — but note per Gen Digital that the patched build still ships Chromium 80 with sandbox and same-origin policy disabled, so patching does not eliminate the structural risk.
• Email/chat link filtering. Ensure mail and collaboration gateways inspect and can neutralise sgbiz: links. Gen explicitly states the link can arrive by email or chat message.
• User advisory to staff with Chinese-language input requirements: do not authorise external-protocol pop-ups for sgbiz: links from untrusted sources.

P3 — within 7 days

• Extend resilience testing to shadow IT. Add end-user-installed applications with embedded browser engines to the scope of DORA Art. 24 testing — this incident demonstrates that a six-year-old embedded Chromium with a disabled sandbox evades standard patch-management visibility.
• Review third-party software policy for consumer input methods on corporate endpoints, and record the residual risk where removal is not feasible.

5. Indicators of compromise

No atomic indicators of compromise (hashes, domains, IPs, URLs) are available in the source material. The source describes observable behaviours and named binaries only.

Behavioural indicators

6. Detection

rule GRAYRABBIT_Sogou_sgbiz_Handler_Abuse
{
    meta:
        author = "Adverse Trace"
        date = "2026-09-11"
        reference = "https://thehackernews.com/2026/09/china-linked-unc3569-exploited-sogou.html"
        description = "Detects abuse of the Sogou Input Method sgbiz: protocol handler chain used to deliver GRAYRABBIT: biz_helper.exe launching SGMyInput.exe with injected arguments, and the embedded Chromium 80 skin-store browser. String artefacts are the named binaries and URI scheme from the Gen Digital research."
    strings:
        $bin_helper = "biz_helper.exe" ascii
        $bin_input = "SGMyInput.exe" ascii
        $scheme = "sgbiz:" ascii
        $skin = "skin store" ascii nocase
    condition:
        3 of them
}

title: Sogou sgbiz Protocol Handler Invoked with Arguments Targeting SGMyInput.exe
id: 00000000-0000-0000-0000-000000000840
status: experimental
description: >
  Detects invocation of the Sogou Input Method protocol handler biz_helper.exe
  via the sgbiz: URI scheme, as abused by UNC3569 to pass unfiltered
  command-line arguments to SGMyInput.exe and open the skin-store browser at an
  attacker-controlled URL. Based on Gen Digital research published 2026-09-11.
references:

  - https://thehackernews.com/2026/09/china-linked-unc3569-exploited-sogou.html
author: Adverse Trace
date: 2026/09/11
logsource:
    category: process_creation
    product: windows
detection:
    selection_handler:
        Image|endswith: '\biz_helper.exe'
    selection_target:
        CommandLine|contains:

            - 'SGMyInput.exe'
            - 'sgbiz:'
    condition: 1 of selection_*
falsepositives:

    - Legitimate Sogou Input Method component launches on hosts where the application is an approved business tool
level: high

7. Sources

• The Hacker News — China-Linked UNC3569 Exploited Sogou Input Method Flaw to Deploy GRAYRABBIT Backdoor — https://thehackernews.com/2026/09/china-linked-unc3569-exploited-sogou.html — 2026-09-11
• Gen Digital — research referenced in the above item (original report not supplied; all technical claims herein derive from The Hacker News coverage of it) — 2026-09-10 (research published Thursday per source)
• Citizen Lab, University of Toronto — 2023 research on Sogou Input Method encryption flaws and user base, cited in the above item

8. Adverse Trace position

This is a credible, technically well-characterised supply-chain-adjacent attack on a massively deployed consumer application, and the structural weakness — a 2020-era embedded Chromium with sandbox and same-origin policy hard-coded off — persists in the patched build, meaning Tencent's April 2026 fix closed one door while leaving the room unlocked. Severity for EMEA financial services is moderate: exploitation requires Sogou Input Method on Windows plus user interaction whose exact friction is disputed between Gen Digital and Tencent, and the actor's historical targeting is concentrated in East and Southeast Asia — but Google assesses the group targets finance, and the US accounts for over 3.3% of Sogou web traffic, so diaspora and regional offices with Chinese-language users are the realistic exposure. Attribution to UNC3569 is single-sourced via Google Threat Intelligence with no MITRE ATT&CK profile and must be treated as unconfirmed; the same applies to the GRAYRABBIT capability set, which is vendor-described rather than independently corroborated in the supplied material. We will monitor for the Gen Digital original report, any CVE/KEV designation, campaign-specific IOCs, and Tencent's follow-up position, and will reissue this advisory if the dispute over the user-interaction requirement resolves or indicators surface.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.