Chinese APT UNC3569 Exploits Tencent Sogou IME Flaw for One-Click RCE

A critical-severity vulnerability in Tencent's Sogou Input Method—one of the most widely used Chinese-language input method editors (IMEs) on Windows, with hundreds of millions of users—is being actively exploited by a China-linked threat actor to deploy a backdoor. Tracked as CVE-2026-51990, the flaw chains three security weaknesses into a one-click exploit: unvalidated command-line argument injection, unrestricted URL navigation, and an outdated, un-sandboxed Chromium browser engine (Chromium 80, released in March 2020) that is missing approximately six years of security patches and has the sandbox and same-origin policy completely disabled. According to Gen Threat Labs, the protocol handler (biz_helper.exe) failed to sanitize the 'param' parameter during sgbiz URL parsing, allowing attackers to inject command-line arguments and trick the embedded browser into loading arbitrary local content.

The exploit chain was weaponized by UNC3569, a threat group potentially linked to Chinese private contractor i-SOON, which is known for targeting government, education, technology, and finance organizations worldwide. Attackers sent crafted sgbiz URLs to victims; a single click granted system-level code execution and triggered the deployment of the GrayRabbit backdoor. Active across UNC3569 intrusions since at least 2021, GrayRabbit provides a reverse shell, process execution, plugin loading, file upload to command-and-control infrastructure, system information collection, and self-termination capabilities. Security teams investigating related infrastructure can use a WHOIS lookup to verify suspicious domains tied to UNC3569's C&C footprint.

Gen Threat Labs reported the vulnerability to Tencent on April 9, and a patch was shipped in Sogou Input Method version 16.3.0.3498 via the software's automatic update mechanism. The fix added validation for URL-bearing switches in the protocol handler, but notably left the underlying Chromium configuration unchanged. As of September 10, the version and configuration had not been updated to address the remaining issues. Users of Sogou Input Method should verify they are running the latest patched build and consider whether the application remains suitable for sensitive environments. For broader exposure assessment, a port scanner can help identify systems running outdated software reachable from the network, and a privacy checkup is recommended to review related attack-surface risks on Windows endpoints.