What Tencent’s Sogou flaw reveals about state-sponsored cyberattacks State-linked hackers targeted users of Sogou Input Method—one of the wo

Gen Digital disclosed CVE-2026-51990 in the Windows build of Sogou Input Method, the Tencent keyboard app holding roughly 70 percent of the Chinese input market with more than 455 million monthly active users per Citizen Lab figures. The flaw is an argument injection in the sgbiz: protocol handler: Windows passes a crafted sgbiz: link to biz_helper.exe, which checked which executable to launch but performed no validation on command-line arguments. Attackers used it to start the Sogou settings program SGMyInput.exe and point its skin store at an attacker-controlled URL, which the app renders in an embedded Chromium 80 build from around March 2020 with the sandbox and same-origin policy manually disabled in code. The landing page exploited CVE-2021-38003, the V8 bug Google patched in October 2021 and CISA KEV-listed that November, yielding code execution at full user privileges with no browser escape required. Google Threat Intelligence attributes the campaign to UNC3569, a China-linked hacker-for-hire group active since at least 2021, and identifies the payload as GRAYRABBIT, a backdoor providing shell access, bidirectional file transfer, and module loading over port 443 using custom RC4-encrypted TCP instead of TLS.

The patch does not retire the primitive. Tencent privately received the report on April 9, 2026 and rolled out 16.3.0.3498 through automatic updates from April 21, but the fix only restricts biz_helper.exe to HTTPS URLs on sogou.com, qq.com, and woa.com. The embedded engine still ships with sandboxing and web security off, so any future path that feeds it a URL restores code execution, and Gen Digital counted at least 32 of the 41 V8 vulnerabilities currently in CISA's KEV catalog as patched in Chrome releases newer than the build Sogou still embeds: a standing inventory of known-working exploits against the component that handles everything a user types. Tencent's own response, disputing the chain as "relatively complex" because it requires the user to authorize a pop-up, concedes the delivery requirement while leaving the engine untouched. Compromise equals persistent user-privilege access from a single link click, and the targeting profile of government, education, technology, and finance across East and Southeast Asia marks this as contracting-driven espionage capability rather than commodity crime. Exposure also does not stop at China's border: over 3.3 percent of Sogou web visits come from the United States, so multinationals with China-facing staff carry real risk.

Confirm Windows endpoints run Sogou 16.3.0.3498 or later, then verify no infection predates the update, since Tencent has not documented whether installing the patch terminates an active GRAYRABBIT implant. Hunt the three SHA-256 values Gen Digital published for the loader 7z.dll (29c7ee41d0cc9e07d981e451df56d0c3d37c41ac4ec10c7b516cc033ee397a63), the encrypted payload p (749160a2f20f82744026719cf72e483595c6aad718efa74d675a98662e02422e), and the backdoor core.dll (d7a3c7eb94edc0e020f74c678743d71d61e944634aade4a67a96c3589e828b3a), and check for 7-Zip loading a DLL out of C:\Users\Public\Documents, where the legitimate install lives under Program Files instead. Alert on biz_helper.exe or SGMyInput.exe process launches, on files written to C:\Users\Public\Documents followed by NTFS alternate data stream relocation and self-deletion, and on any process chain where a skin store fetch precedes 7-Zip execution. On the network side, watch for DNS or TCP sessions to mail.uaiubifas[.]top, noht1ng[.]top, and 8.218.50[.]207, and flag port 443 traffic lacking a TLS ClientHello, since GRAYRABBIT masks RC4-encrypted TCP as web traffic.

Two developments would change this assessment. A Tencent engine update that removes or sandboxes the Chromium 80 skin-store browser would close the bug class rather than one URL path, and its absence leaves Gen Digital's conclusion standing that the component remains fundamentally vulnerable to any new route for arbitrary URLs. A KEV listing for CVE-2026-51990, or new GRAYRABBIT infrastructure beyond the currently known domain, host, and staging IP, would signal the operation has widened beyond UNC3569's targeted intrusions into broader availability.