Full Report
A China-linked hacking group exploited a flaw in Sogou Input Method, one of the most widely used tools for typing Chinese characters on Windows, to install a backdoor on victims' computers, security company Gen Digital said in research published Thursday. The attack started with a crafted link and ended with the attacker able to do anything the logged-in user could do. Tencent, which owns
Analysis Summary
# Main Topic
**China‑linked UNC3569 exploited a flaw in the Sogou Input Method (SIM) to deploy the GRAYRABBIT backdoor on Windows systems.** The attack chain began with a crafted `sgbiz:` link, bypassed input validation, launched a Chromium‑based browser with disabled sandboxing, and leveraged the CVE‑2021‑38003 JavaScript engine flaw to gain code execution, after which the GRAYRABBIT backdoor was installed.
## Key Points
- **Targeted Tool:** Sogou Input Method (SIM), the most popular Chinese input method on Windows, with ~455 M monthly users worldwide.
- **Exploit Vector:** Malicious `sgbiz:` link that opens `biz_helper.exe` → `SGMyInput.exe` → the skin‑store browser window. No validation of command‑line arguments or URL.
- **Browser Vulnerability:** SIM’s embedded Chromium (v80, March 2020) had the sandbox and same‑origin policy disabled, allowing a JavaScript exploit (CVE‑2021‑38003) to run arbitrary code with user privileges.
- **Backdoor:** GRAYRABBIT, a small, modular backdoor providing a remote shell, bi‑directional file transfer, and dynamic module loading.
- **Patch Status:** Tencent fixed the SIM flaw in April 2026, but the embedded browser remained vulnerable until the 2026 patch.
- **Impact Scope:** Victims were able to perform any action the logged‑in user could, effectively giving full system control to the attacker.
## Threat Actors
- **UNC3569** – China‑linked hacking group, part of the country’s hacker‑for‑hire ecosystem.
- **Motivation:** Targeted government, education, technology, and finance sectors in East and Southeast Asia (Google Threat Intelligence, 2021‑present).
- **Campaign History:** Google has tracked UNC3569 since 2021; the group has used GRAYRABBIT for years as a first‑stage foothold.
## TTPs
| Phase | Technique | MITRE ATT&CK ID | Description |
|-------|-----------|-----------------|-------------|
| Initial Access | Spearphishing Link | T1192 | Victim clicks a crafted `sgbiz:` link sent via email or chat. |
| Execution | User Execution | T1204 | The link triggers execution of `biz_helper.exe` and `SGMyInput.exe`. |
| Privilege Escalation | Exploit Public-Facing Application | T1068 | CVE‑2021‑38003 in V8 JavaScript engine is triggered by the malicious web page. |
| Persistence | Install Root Certificate / Backdoor | — | GRAYRABBIT installs itself and registers a remote shell. |
| Command & Control | Remote Execution | T1059 | GRAYRABBIT loads modules from the attacker’s server. |
| Data Exfiltration | Exfiltration Over Command and Control Channel | T1041 | Files moved bi‑directionally via GRAYRABBIT. |
## Affected Systems
- **Operating System:** Windows (all recent versions).
- **Software:** Sogou Input Method (Windows version, pre‑April 2026).
- **Browser Engine:** Embedded Chromium v80 (March 2020), sandbox disabled, same‑origin policy disabled.
- **User Base:** Broad, including government, education, technology, and finance sectors in East/Southeast Asia; also users outside China (e.g., U.S. 3.3 % of visits).
## Mitigations
- **Patch SIM:** Install the April 2026 patch from Tencent that removes the vulnerability in the custom `sgbiz:` protocol handler.
- **Update Embedded Browser:** Ensure the embedded Chromium is updated to a version where sandboxing is enabled and the CVE‑2021‑38003 patch is applied.
- **Disable Custom Protocol Handlers:** If patching is delayed, disable `sgbiz:` links or uninstall SIM entirely.
- **Endpoint Protection:** Deploy EDR/AV that detects execution of `biz_helper.exe`/`SGMyInput.exe` with suspicious arguments and blocks GRAYRABBIT binaries.
- **Email/Chat Filtering:** Block or quarantine suspicious `sgbiz:` links and educate users on the risks of clicking unknown links.
- **Patch CVE‑2021‑38003:** Apply the NVD‑listed patch for the V8 JavaScript engine on all affected systems.
- **Network Segmentation:** Restrict outbound connections from potential victim machines to known C&C domains.
- **Monitoring:** Watch for anomalous remote shell activity, file transfer patterns, and module loading requests.
## Conclusion
The UNC3569 campaign demonstrates a sophisticated chain of exploitation that leverages a legacy input‑method flaw, a disabled browser sandbox, and a known JavaScript engine vulnerability to deliver a powerful backdoor. The attack underscores the importance of timely patching for third‑party components, strict input validation for custom protocol handlers, and robust user‑education around phishing links. Organizations with SIM users should immediately apply the April 2026 fix, update embedded browsers, and enforce endpoint detection controls to mitigate this threat.