China-Linked UNC3569 Exploited Sogou Input Method Flaw to Deploy GRAYRABBIT Backdoor

Security researchers at Gen Digital disclosed that China-linked threat actor UNC3569 leveraged a vulnerability in the Windows version of Sogou Input Method to install the GRAYRABBIT backdoor on victim systems. The attack chain involved manipulating an unvalidated sgbiz link handler to execute a JavaScript exploit for CVE-2021-38003 within Sogou's outdated Chromium 80 browser engine, which had sandboxing disabled. Although Tencent issued a patch for this issue, tracked as CVE-2026-51990, in version 16.3.0.3498, the underlying browser engine remains vulnerable due to its age and lack of modern security controls.