A Chinese hacking group exploited a vulnerability in Sogou Input Method — the most widely used tool for typing Chinese characters on Windows, with roughly 455 million active users monthly — to install the GRAYRABBIT backdoor on victims’ machines. The attack starts with a crafted link that exploits Sogou’s built-in browser engine, which runs a 2020-era codebase with sandboxing disabled, allowing the attacker to execute code with the same privileges as the logged-in user. Security firm Gen Digital discovered the campaign while investigating a live intrusion and published its findings on Thursday.
The group behind the attacks is UNC3569, which Google Threat Intelligence links to China’s hacker-for-hire ecosystem. It has been active since at least 2021 and has targeted government agencies, educational institutions, technology companies, and financial services firms, primarily in East and Southeast Asia. GRAYRABBIT is the group’s standard first-stage implant: a lightweight backdoor that opens a remote command shell, supports bidirectional file transfer, and can pull down additional modules from the attacker’s server at any time. Tencent, which develops and maintains Sogou, patched the specific attack path in April 2026 — but Gen’s analysis of the patched version found that the built-in browser engine is still running the old 2020 code and its sandbox remains off, meaning the attack surface has narrowed but not closed.
How to check if you’re affected
Affected versions of Sogou Input Method for Windows include all releases prior to the April 2026 update. If your organization deploys Sogou on Windows workstations — particularly in government, education, finance, or technology sectors that are primary UNC3569 targets — verify that the software has been updated and review endpoints for signs of unauthorized remote-access activity such as unexpected outbound connections or newly created scheduled tasks.