Unpatched Tencent Sogou Flaw Exploited to Deploy GrayRabbit Backdoor
Written by AI from the linked story. Not reviewed by an editor. How this works
UNC3569, a China-aligned threat actor, is actively exploiting CVE-2026-51990, a critical one-click remote code execution vulnerability in Tencent's Sogou Input Method for Windows. The attack chains multiple weaknesses — including a vulnerable protocol handler, webview component, and an outdated Chromium engine — to deploy the GrayRabbit backdoor without meaningful user interaction. This highlights the compounding risk of shipping software with embedded, outdated third-party engines that expand the attack surface far beyond what organizations typically track. The incident underscores that widely deployed productivity and input tools are increasingly targeted as soft entry points into enterprise environments, and that delayed patching of non-obvious software creates critical blind spots in vulnerability programs.
Tactical Insight
Immediate actions
- Apply the latest Tencent Sogou Input Method patch or remove the application from enterprise endpoints until a fix is confirmed safe.
- Run an authenticated vulnerability scan across all endpoints to identify instances of outdated Chromium-based embedded engines in third-party applications.
- Block or restrict custom protocol handlers (URI schemes) associated with Sogou Input Method at the endpoint and network perimeter until patched.
Long-term improvements
- Maintain a comprehensive Software Bill of Materials (SBOM) to track embedded third-party libraries and engines (e.g., Chromium) across all deployed applications.
- Establish a formal patch prioritization process that includes non-traditional software such as input methods, utilities, and productivity tools — not just OS and browsers.
- Enforce application allowlisting policies to limit execution of unexpected binaries spawned by input method or webview processes.
Detection measures
- Deploy EDR rules to alert on suspicious child processes spawned by input method applications or embedded webview components.
- Monitor network traffic for C2 communication patterns associated with GrayRabbit backdoor indicators of compromise (IoCs).
- Enable enhanced logging for protocol handler invocations and webview activity on endpoints to support rapid forensic investigation.