Hackers Target Tencent App Vulnerability to Install GrayRabbit Malware

Post Views: 4

Hackers exploit Tencent app flaw to deploy GrayRabbit malware

Threat Actors and Vulnerability

Threat actors associated with a China-aligned espionage group have leveraged a critical vulnerability (CVE-2026-51990) in Tencent’s Sogou Input Method for Windows to deploy the GrayRabbit backdoor. Security researchers at Gen Digital identified the flaw as a one-click remote code execution (RCE) vulnerability. The threat group, designated UNC3569, used a malicious link to trigger the exploit, according to findings from Gen Threat Labs.

Sogou Input Method Overview

Sogou Input Method, a widely used Windows application for typing Chinese characters, includes a custom link handler and an embedded web browser based on an outdated Chromium engine. The software, developed by Tencent, has an estimated hundreds of millions of users in China.

Exploitation Details

Gen Threat Labs disclosed that UNC3569 exploited three specific weaknesses in the application: an unvalidated command-line argument injection in the sgbiz: URI protocol, unrestricted URL navigation in a CEF-based webview, and the use of an unsandboxed Chromium browser engine.

Attack Sequence

The attack sequence begins when a user interacts with a malicious sgbiz: URI, which triggers the biz_helper.exe protocol handler. This handler passes unvalidated command-line arguments to the SGMyInput.exe executable. These arguments initiate the skincenter component, which loads a malicious URL through the embedded Chromium webview.

Chromium Engine Vulnerabilities

The outdated Chromium 80 engine, which lacks sandboxing and essential security protections, allows the attacker to execute code and install the GrayRabbit backdoor.

GrayRabbit Malware Analysis

GrayRabbit, a modular malware family linked to UNC3569, was first documented by Google researchers in 2024. The variant analyzed by Gen Threat Labs is a 64-bit version with expanded capabilities, including process execution, interactive reverse shell creation, and file uploads. The malware’s command-and-control (C2) configuration is encoded using RC4.

Patch and Ongoing Risks

Gen Threat Labs reported the vulnerability to Tencent on April 9, prompting the release of a patch in Sogou Input Method version 16.3.0.3498 on April 21. The update enforces URL validation, restricts protocol handlers to HTTPS, and limits navigation to approved domains. Despite the fix, researchers highlighted that the underlying Chromium engine remains outdated, continues to operate without sandboxing, and lacks critical web security features.

Conclusion and Recommendations

The incident underscores ongoing risks posed by legacy software components and the persistent activities of state-sponsored threat groups targeting enterprise and government systems. Security teams are advised to apply the latest updates and monitor for indicators of compromise associated with GrayRabbit.