CTI · reviewed · 2026-09-14

Hackers exploit Tencent app flaw to deploy GrayRabbit malware

Full story & timeline

MITRE ATT&CK

• T1190 Exploit Public-Facing Application Initial Access
• T1059 Command and Scripting Interpreter Execution
• T1203 Exploitation for Client Execution Execution
• T1038 DLL Search Order Hijacking Persistence
• T1573 Encrypted Channel Command and Control

Indicators

Observables tied to this case, from the curated feed. raw sidecar

• mail.uaiubifas domain · expired

Detections

Detection content derived from this case analysis. Status: experimental — not validated against live telemetry.

Sigma raw

title: GrayRabbit Backdoor via Sogou Input Method CVE-2026-51990 Exploitation
id: a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects exploitation of CVE-2026-51990 in Tencent Sogou Input Method where the sgbiz protocol handler passes unsanitized arguments to SGMyInput.exe leading to GrayRabbit backdoor deployment via an embedded Chromium webview
references:
  - https://www.bleepingcomputer.com/news/security/hackers-exploit-tencent-app-flaw-to-deploy-grayrabbit-malware/
author: Tia N. List
date: 2026-09-14
tags:
  - attack.initial-access
  - attack.t1190
  - attack.execution
  - attack.t1203
logsource:
  product: windows
  category: process_creation
detection:
  selection_sgmyinput:
    Image|endswith:
      - '\SGMyInput.exe'
    CommandLine|contains:
      - 'skincenter'
      - 'http://'
      - 'https://'
  selection_biz_helper:
    Image|endswith:
      - '\biz_helper.exe'
    CommandLine|contains:
      - 'sgbiz:'
  selection_suspicious_dll_drop:
    Image|endswith:
      - '\rundll32.exe'
    CommandLine|contains:
      - 'C:\Users\Public\Documents\7z.dll'
      - 'C:\Users\Public\Documents\SkinHelper.dll'
  condition: selection_sgmyinput or selection_biz_helper or selection_suspicious_dll_drop
falsepositives:
  - Legitimate Sogou Input Method skin store operations
level: high

YARA-X raw

rule GrayRabbit_Backdoor_Sogou_Exploit {
  meta:
    author = "Tia N. List"
    date = "2026-09-14"
    status = "experimental"
    description = "Detects GrayRabbit backdoor deployed via CVE-2026-51990 exploitation of Tencent Sogou Input Method"
    reference = "https://www.bleepingcomputer.com/news/security/hackers-exploit-tencent-app-flaw-to-deploy-grayrabbit-malware/"
    falsepositives = "None known"
    hash_loader = "29c7ee41d0cc9e07d981e451df56d0c3d37c41ac4ec10c7b516cc033ee397a63"
    hash_payload = "749160a2f20f82744026719cf72e483595c6aad718efa74d675a98662e02422e"
    hash_binary = "d7a3c7eb94edc0e020f74c678743d71d61e944634aade4a67a96c3589e828b3a"

  strings:
    $c2_domain = "mail.uaiubifas" ascii nocase
    $sogou_path = "\\SGMyInput.exe" ascii
    $skincenter = "skincenter" ascii
    $gbiz_uri = "sgbiz:" ascii
    $public_docs = "C:\\Users\\Public\\Documents" ascii
    $7z_dll = "7z.dll" ascii
    $ntfs_ads = "NTFS" ascii
    $ntfs_delete = ":$DATA" ascii

  condition:
    uint16(0) == 0x5A4D and
    filesize < 5MB and
    3 of ($c2_domain, $sogou_path, $skincenter, $gbiz_uri, $public_docs, $7z_dll, $ntfs_ads, $ntfs_delete)
}

References

• https://www.bleepingcomputer.com/news/security/hackers-exploit-tencent-app-flaw-to-deploy-grayrabbit-malware/