[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$ff4BpSbhGNOiZvmgf5s8YwRPDGvwBKIbpBRaJeUArEAM":3},{"article":4,"iocs":52,"watch_terms":60,"solutions":61,"lesson":151},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":29,"category":30,"article_tags":34},"46ae7fdb-374b-4ff6-b92f-a75a22927dca","Hackers exploit Tencent app flaw to deploy GrayRabbit malware","hackers-exploit-tencent-app-flaw-to-deploy-grayrabbit-malware-b2a972","Threat actors linked to a China-aligned espionage group are exploiting a critical vulnerability (CVE-2026-51990) in Tencent's Sogou Input Method for Windows to deploy the GrayRabbit backdoor. [...]","China-aligned threat actors, identified as UNC3569, are exploiting a critical one-click RCE vulnerability (CVE-2026-51990) in Tencent's Sogou Input Method for Windows. This flaw allows them to deploy the GrayRabbit backdoor by chaining together multiple weaknesses in the application's protocol handler, webview, and outdated Chromium engine.","Hackers exploit Tencent app flaw to deploy GrayRabbit malware via UNC3569 group.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fhackers-exploit-tencent-app-flaw-to-deploy-grayrabbit-malware\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F09\u002F11\u002Frabbit.jpg","2026-09-13T14:26:32+00:00","2026-09-13T16:00:12.554291+00:00",9,[17,20,23,26],{"name":18,"type":19},"Sogou Input Method","product",{"name":21,"type":22},"Tencent","vendor",{"name":24,"type":25},"UNC3569","threat_actor",{"name":27,"type":28},"Chromium","technology","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":29,"icon":31,"name":32,"slug":33},null,"Malware","malware",[35,40,45,47],{"category":36},{"id":37,"icon":31,"name":38,"slug":39},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":41},{"id":42,"icon":31,"name":43,"slug":44},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":46},{"id":29,"icon":31,"name":32,"slug":33},{"category":48},{"id":49,"icon":31,"name":50,"slug":51},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[53,57],{"type":54,"value":55,"context":56},"cve","CVE-2026-51990","Critical vulnerability in Tencent's Sogou Input Method for Windows exploited by UNC3569.",{"type":33,"value":58,"context":59},"GrayRabbit","Backdoor malware deployed by UNC3569.",[21,18],{"controls":62,"vendors":150},[63,92,121],{"slug":64,"name":65,"problem":66,"products":67},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[68,76,84],{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"slug":93,"name":94,"problem":95,"products":96},"patch-management","Automated patch management","Known holes get closed in days, not months.",[97,105,113],{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":117,"product_name":118,"url":119,"description":120},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"slug":122,"name":123,"problem":124,"products":125},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[126,134,142],{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":135,"vendor_name":136,"vendor_logo":137,"product_slug":138,"product_name":139,"url":140,"description":141},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"vendor_slug":143,"vendor_name":144,"vendor_logo":145,"product_slug":146,"product_name":147,"url":148,"description":149},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",[],{"slug":152,"title":153,"body":154,"framework_refs":155,"framework_notes":167},"unpatched-tencent-sogou-flaw-exploited-to-deploy-grayrabbit-backdoor","Unpatched Tencent Sogou Flaw Exploited to Deploy GrayRabbit Backdoor","UNC3569, a China-aligned threat actor, is actively exploiting CVE-2026-51990, a critical one-click remote code execution vulnerability in Tencent's Sogou Input Method for Windows. The attack chains multiple weaknesses — including a vulnerable protocol handler, webview component, and an outdated Chromium engine — to deploy the GrayRabbit backdoor without meaningful user interaction. This highlights the compounding risk of shipping software with embedded, outdated third-party engines that expand the attack surface far beyond what organizations typically track. The incident underscores that widely deployed productivity and input tools are increasingly targeted as soft entry points into enterprise environments, and that delayed patching of non-obvious software creates critical blind spots in vulnerability programs.",[156,157,158,159,160,161,162,163,164,165,166],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 7: Continuous Vulnerability Management","CIS Control 10: Malware Defenses","CIS Control 13: Network Monitoring and Defense","NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management Planning","NIST SI-2: Flaw Remediation","NIST SA-12: Supply Chain Risk Management","NIST CM-7: Least Functionality (restrict protocol handlers)","MITRE ATT&CK T1203: Exploitation for Client Execution","MITRE ATT&CK T1071: Application Layer Protocol (C2)","ITIL: Change and Release Management (emergency patch procedures)",{}]