[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f1oGWqvPaDHr1khHPQTJpsQlHmGq6fXir2hXD1-gBsUQ":3},{"article":4,"iocs":53,"watch_terms":67,"solutions":68,"lesson":161},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"cbbcbf68-d3e7-403d-848d-653ab6ea5a71","China-Linked UNC3569 Exploited Sogou Input Method Flaw to Deploy GRAYRABBIT Backdoor","china-linked-unc3569-exploited-sogou-input-method-flaw-to-deploy-grayrabbit-back-11c8b5","A China-linked hacking group exploited a flaw in Sogou Input Method, one of the most widely used tools for typing Chinese characters on Windows, to install a backdoor on victims' computers, security company Gen Digital said in research published Thursday. The attack started with a crafted link and ended with the attacker able to do anything the logged-in user could do. Tencent, which owns","A China-linked hacking group, identified as UNC3569, exploited a vulnerability in the widely-used Sogou Input Method for Windows to deploy the GRAYRABBIT backdoor. The attack chain involved a crafted link that, when clicked, allowed attackers to execute commands with the user's privileges due to a disabled sandbox and other security misconfigurations in the input method's embedded browser engine. Tencent, the owner of Sogou, has since patched the flaw.","China-linked UNC3569 group exploited Sogou Input Method flaw to deploy GRAYRABBIT backdoor.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002Fchina-linked-unc3569-exploited-sogou.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEjp8vDxYtUGwWuRZlSSBh2ghvSf6GTi_VlTQSQXTaIWSlQgHY_imEfl4hyAcrhPz9w3_ejmdAKK7ZeOt5gBsNZI7mhxJsnbyLT8Bo6O6HdM01yCNuDjuz-IU64LRuAuVDOzh2Z0vLhvzwP9PUUBKE_OLn0YD7m74-kZpo1dr5c0hzCMRHxrgfIzjk9MnR4\u002Fs1600\u002Fchinese.jpg","2026-09-11T07:14:09+00:00","2026-09-11T08:00:04.429808+00:00",8,[17,20,23,26,28],{"name":18,"type":19},"UNC3569","threat_actor",{"name":21,"type":22},"Sogou Input Method","product",{"name":24,"type":25},"Tencent","vendor",{"name":27,"type":25},"Gen Digital",{"name":29,"type":25},"Google","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":30,"icon":32,"name":33,"slug":34},null,"Nation-state","nation-state",[36,38,43,48],{"category":37},{"id":30,"icon":32,"name":33,"slug":34},{"category":39},{"id":40,"icon":32,"name":41,"slug":42},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":44},{"id":45,"icon":32,"name":46,"slug":47},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":49},{"id":50,"icon":32,"name":51,"slug":52},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[54,57,61,64],{"type":47,"value":55,"context":56},"GRAYRABBIT","Backdoor deployed by UNC3569",{"type":58,"value":59,"context":60},"mitre_attack","T1059.003","Exploitation of custom link handler (sgbiz:) to execute commands",{"type":58,"value":62,"context":63},"T1204.001","User execution: Malicious Link",{"type":58,"value":65,"context":66},"T1105","Ingress Tool Transfer: Ability to load additional modules from attacker's server",[29,24,27],{"controls":69,"vendors":155},[70,98,127],{"slug":71,"name":72,"problem":73,"products":74},"patch-management","Automated patch management","Known holes get closed in days, not months.",[75,83,90],{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":71,"product_name":87,"url":88,"description":89},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"slug":99,"name":100,"problem":101,"products":102},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[103,111,119],{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":123,"product_name":124,"url":125,"description":126},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"slug":52,"name":128,"problem":129,"products":130},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[131,139,147],{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":135,"product_name":136,"url":137,"description":138},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","recorded-future-cyber-operations","Recorded Future Cyber Operations","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fcyber-operations","Threat intelligence built into security operations workflows, to prioritise alerts and act on threats before they arrive.",{"vendor_slug":140,"vendor_name":141,"vendor_logo":142,"product_slug":143,"product_name":144,"url":145,"description":146},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",{"vendor_slug":148,"vendor_name":149,"vendor_logo":150,"product_slug":151,"product_name":152,"url":153,"description":154},"reliaquest","ReliaQuest","\u002Fvendor-logos\u002Freliaquest.png","greymatter-digital-risk-protection","GreyMatter Digital Risk Protection","https:\u002F\u002Freliaquest.com\u002Fsecurity-operations-platform\u002Fdark-web-and-digital-risk-protection\u002F","Watches the open, deep and dark web for threats aimed at an organisation and alerts its security team in real time.",[156],{"slug":157,"name":29,"logo_path":158,"roles":159},"google","\u002Fvendor-logos\u002Fgoogle.png",[160],"reported_by",{"slug":162,"title":163,"body":164,"framework_refs":165,"framework_notes":177},"sogou-input-method-flaw-exploited-to-deploy-grayrabbit-backdoor","Sogou Input Method Flaw Exploited to Deploy GRAYRABBIT Backdoor","UNC3569 exploited a vulnerability in Sogou Input Method for Windows, leveraging a disabled sandbox and security misconfigurations in the software's embedded browser engine to execute malicious commands via a crafted link. This attack highlights the danger of third-party software — including seemingly benign productivity tools like input methods — carrying exploitable flaws with significant attack surface. The disabled sandbox effectively removed a critical layer of defense-in-depth, allowing the attackers to escalate from a simple user interaction to full backdoor deployment. This matters because widely-deployed regional software often escapes rigorous enterprise security scrutiny, making it an attractive vector for nation-state threat actors.",[166,167,168,169,170,171,172,173,174,175,176],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 7: Continuous Vulnerability Management","CIS Control 4: Secure Configuration of Enterprise Assets and Software","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 CM-6: Configuration Settings","NIST SP 800-53 CM-7: Least Functionality","NIST SP 800-53 RA-5: Vulnerability Monitoring and Scanning","NIST CSF ID.AM-2: Software platforms and applications are inventoried","MITRE ATT&CK T1189: Drive-by Compromise","MITRE ATT&CK T1059: Command and Scripting Interpreter","ISO\u002FIEC 27001 A.12.6.1: Management of Technical Vulnerabilities",{}]