China-Linked UNC3569 Exploited Sogou Input Method Flaw to Deploy GRAYRABBIT Backdoor

UNC3569 exploited a vulnerability in Sogou Input Method for Windows, leveraging a disabled sandbox and security misconfigurations in the software's embedded browser engine to execute malicious commands via a crafted link. This attack highlights the danger of third-party software — including seemingly benign productivity tools like input methods — carrying exploitable flaws with significant attack surface. The disabled sandbox effectively removed a critical layer of defense-in-depth, allowing the attackers to escalate from a simple user interaction to full backdoor deployment. This matters because widely-deployed regional software often escapes rigorous enterprise security scrutiny, making it an attractive vector for nation-state threat actors.