[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f1l4CGx-vavfD0PsyLWmRwpX6_e2EftXlcbPECZ2WjNw":3},{"article":4,"iocs":52,"watch_terms":60,"solutions":61,"lesson":151},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":29,"category":30,"article_tags":34},"b97ffb04-4ae5-4985-9cb0-a176bbb141f4","Chinese Hackers Exploit Critical Tencent Software Flaw for One-Click Code Execution","chinese-hackers-exploit-critical-tencent-software-flaw-for-one-click-code-execut-13ffad","The Chinese-language input method editor for Windows can allow attackers to execute arbitrary code remotely. The post Chinese Hackers Exploit Critical Tencent Software Flaw for One-Click Code Execution appeared first on SecurityWeek.","A critical vulnerability (CVE-2026-51990) in Tencent's popular Sogou Input Method editor for Windows has been exploited by the Chinese threat actor UNC3569. The exploit chains three weaknesses to achieve one-click remote code execution, allowing the deployment of the GrayRabbit backdoor. The vulnerability was patched in version 16.3.0.3498, but the underlying outdated browser engine remains unaddressed.","Chinese hackers exploit Tencent's Sogou Input Method flaw for one-click code execution.","https:\u002F\u002Fwww.securityweek.com\u002Fchinese-hackers-exploit-critical-tencent-software-flaw-for-one-click-code-execution\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2025\u002F07\u002FChina-Chinese-hacker.jpg","2026-09-14T11:51:29+00:00","2026-09-14T12:00:10.359741+00:00",9,[17,20,23,26],{"name":18,"type":19},"Tencent","vendor",{"name":21,"type":22},"Sogou Input Method","product",{"name":24,"type":25},"UNC3569","threat_actor",{"name":27,"type":28},"Chromium","technology","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":29,"icon":31,"name":32,"slug":33},null,"Vulnerabilities","vulnerabilities",[35,40,42,47],{"category":36},{"id":37,"icon":31,"name":38,"slug":39},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":41},{"id":29,"icon":31,"name":32,"slug":33},{"category":43},{"id":44,"icon":31,"name":45,"slug":46},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":48},{"id":49,"icon":31,"name":50,"slug":51},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[53,57],{"type":54,"value":55,"context":56},"cve","CVE-2026-51990","Critical vulnerability in Sogou Input Method",{"type":46,"value":58,"context":59},"GrayRabbit","Backdoor deployed by UNC3569",[18,21],{"controls":62,"vendors":150},[63,92,121],{"slug":64,"name":65,"problem":66,"products":67},"patch-management","Automated patch management","Known holes get closed in days, not months.",[68,76,84],{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"slug":93,"name":94,"problem":95,"products":96},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[97,105,113],{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":117,"product_name":118,"url":119,"description":120},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"slug":122,"name":123,"problem":124,"products":125},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[126,134,142],{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png","harmony-email","Harmony Email & Collaboration","https:\u002F\u002Fwww.checkpoint.com\u002Fharmony\u002Femail-security\u002F","Email and collaboration security for Microsoft 365 and Google Workspace.",{"vendor_slug":135,"vendor_name":136,"vendor_logo":137,"product_slug":138,"product_name":139,"url":140,"description":141},"mimecast","Mimecast","\u002Fvendor-logos\u002Fmimecast.png","mimecast-email-security","Mimecast Email Security","https:\u002F\u002Fwww.mimecast.com\u002Fproducts\u002Femail-security\u002F","Email filtering, impersonation protection and continuity.",{"vendor_slug":143,"vendor_name":144,"vendor_logo":145,"product_slug":146,"product_name":147,"url":148,"description":149},"abnormal","Abnormal AI","\u002Fvendor-logos\u002Fabnormal.png","abnormal-email-security","Abnormal Inbound Email Security","https:\u002F\u002Fabnormal.ai\u002F","API-based email security for Microsoft 365 and Google Workspace using behavioural models.",[],{"slug":152,"title":153,"body":154,"framework_refs":155,"framework_notes":168},"unpatched-tencent-sogou-flaw-enables-one-click-backdoor-deployment","Unpatched Tencent Sogou Flaw Enables One-Click Backdoor Deployment","A critical vulnerability in Tencent's Sogou Input Method editor was exploited by the threat actor UNC3569, chaining three weaknesses to achieve one-click remote code execution and deploy the GrayRabbit backdoor. The root cause lies in a failure to fully remediate the underlying outdated browser engine embedded within the software, even after issuing a patch for the immediate CVE. This highlights a common and dangerous pattern where vendors address the symptom (the specific CVE) without resolving the underlying architectural risk (a legacy, unpatched third-party component). Organizations relying on widely deployed software like input method editors — often overlooked in patch cycles — face significant exposure, especially when threat actors actively target these blind spots. Timely patching combined with proactive third-party component auditing is essential to closing these gaps.",[156,157,158,159,160,161,162,163,164,165,166,167],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 7: Continuous Vulnerability Management","CIS Control 10: Malware Defenses","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 SA-12: Supply Chain Protection","NIST SP 800-53 CM-7: Least Functionality","NIST CSF ID.AM-2: Software platforms and applications within the organization are inventoried","NIST CSF RS.MI-3: Newly identified vulnerabilities are mitigated or documented as accepted risks","MITRE ATT&CK T1203: Exploitation for Client Execution","MITRE ATT&CK T1546: Event Triggered Execution (persistence via backdoor)","ISO\u002FIEC 27001 A.12.6.1: Management of Technical Vulnerabilities","ITIL Change Management: Emergency Change procedures for critical vulnerability patching",{}]