Sogou Input Method flaw exploited to deploy GRAYRABBIT backdoor in UNC3569 intrusion
A critical Windows flaw in Sogou Input Method turned a crafted sgbiz: link into a path to attacker-controlled browser code and the GRAYRABBIT backdoor. Gen Digital says UNC3569 exploited the weakness in the wild; Tencent patched the entry point in April, but the bundled Chromium engine remains outdated and sandbox-disabled.
Cisco Secure Email Gateway is supposed to sit between an organization and one of its most heavily abused attack paths: email. A newly disclosed vulnerability in its parsing layer changes that risk calculation dramatically. Cisco says CVE-2026-76461 is being actively exploited and can allow an unauthenticated remote attacker to reach the underlying operating system with root privileges.
The flaw sits in the email-parsing logic of Cisco AsyncOS. An attacker does not need an account on the appliance or an employee to click a link. According to Cisco, the attack can begin with a crafted email containing malicious SQL statements that is processed by an affected gateway. A successful exploit can turn that input into arbitrary command execution at the highest privilege level on the appliance.
That combination is what makes this more than a routine patch-day vulnerability. The affected product is the Cisco Secure Email Gateway, in both physical and virtual form, and Cisco says the exposure applies regardless of device configuration. Cisco also says there is no workaround that fixes the underlying problem. Secure Email and Web Manager and Secure Web Appliance are not affected by this specific flaw.
Cisco rates CVE-2026-76461 at 9.8, and the company says its Product Security Incident Response Team became aware of active exploitation in September. Cisco released fixed software at the same time as the advisory. For 15.5 and earlier, the first fixed release is 15.5.5-014; for 16.0 it is 16.0.4-302; and for 16.5 it is 16.5.0-780. Cisco recommends migrating to 16.5.0-780.
The operational response should therefore start with inventory, not assumptions. Security teams should identify every Secure Email Gateway appliance and its AsyncOS release, verify whether the appliance is on a fixed version, and review the mail_logs for suspicious SQL statements. Cisco specifically points defenders to the gateway logs when checking for attempted exploitation. Network and management-plane telemetry should be reviewed alongside those logs because a root-level compromise of an email security appliance can have consequences beyond the appliance itself.
Cisco has also described a separate response path for its Secure Email Cloud customers. The company says it investigated cloud devices, directly contacted customers where indicators of possible compromise were identified, and deployed mitigations under its control. Customers who were contacted are advised to restore a secure configuration and renew credentials and cryptographic material where possible.
What remains important for defenders is the distinction between a vulnerable system and a compromised one. Installing the fixed release closes the known vulnerability, but it does not by itself answer whether an attacker already obtained access. Any appliance showing suspicious log activity should be investigated as a potential incident, with credentials and cryptographic material rotated as appropriate. CDF will treat further exploitation reporting, new indicators and revised Cisco guidance as updates to the same developing story rather than separate news events.
What happened
Gen Digital traced an active UNC3569 intrusion to a critical remote-code-execution flaw in the Windows version of Sogou Input Method, tracked as CVE-2026-51990.
The attack chain started with a crafted sgbiz: link. Sogou's biz_helper.exe validated which component to launch but did not properly validate the command-line arguments passed to it, allowing an attacker to steer SGMyInput.exe toward an attacker-controlled web address.
That browser stage then exposed an old, security-weakened Chromium environment to an exploit. In the observed intrusion, the chain was used to deliver the GRAYRABBIT backdoor.
What changed
Tencent completed a fix on April 21, 2026 and pushed it through automatic update as Sogou Input Method version 16.3.0.3498, according to Gen Digital.
The patch moves the main defense to the protocol-handler entry point: URL-bearing arguments are checked, non-HTTPS URLs are rejected, and navigation is restricted to an allowlist of trusted domains.
Gen's analysis also found that the embedded browser component itself remains based on Chromium 80 and retains disabled sandbox and web-security protections.
Who is affected
The immediate exposure is for Windows systems running vulnerable Sogou Input Method versions before the April 2026 fix.
The reporting links UNC3569 activity to government, education, technology and finance targets, with a concentration in East and Southeast Asia.
Why it matters
The important lesson is not just the CVE number. A trusted desktop application became an initial-access bridge: a link handler accepted attacker-controlled arguments, an embedded browser accepted attacker-controlled navigation, and an outdated browser engine provided additional exploitation surface.
The case also shows why patching the first vulnerable component is not always the same as eliminating the underlying security debt.
Technical details
Gen describes a chain involving the sgbiz: protocol handler, unrestricted navigation in the application's embedded webview, and a bundled Chromium 80 engine running without normal browser sandbox protections.
The observed exploit page used CVE-2021-38003, a V8 vulnerability fixed by Google in Chrome 95. Because the Sogou bundle was based on Chromium 80, the old browser remained exposed to vulnerabilities fixed years earlier.
After code execution, the observed intrusion staged a legitimate 7-Zip executable alongside a malicious DLL and an encrypted payload. The final payload was identified as the GRAYRABBIT backdoor.
Response
Gen reported the vulnerability to Tencent on April 9, 2026. Tencent acknowledged it the next day and confirmed the fix on April 21.
Tencent's fix blocks the observed link-handler route, but Gen's post-disclosure analysis says the embedded Chromium component was not upgraded as part of that fix.
What security teams should do
Verify the installed Sogou Input Method version on Windows endpoints and ensure version 16.3.0.3498 or later is deployed where applicable.
Hunt EDR telemetry for unusual sgbiz: protocol launches, unexpected SGMyInput.exe child processes, and browser activity originating from Sogou components.
If a potentially exposed endpoint shows signs of execution, do not assume that applying the patch removes an existing implant. Investigate the endpoint and related account activity.
What remains unknown
Public reporting does not establish the complete affected-version range for Sogou Input Method.
There is no public confirmed victim count for the observed UNC3569 intrusion.
It is not publicly established whether installing the patch automatically removes an already-running GRAYRABBIT implant.
Attribution
Gen Digital reported the vulnerability and observed UNC3569 exploitation.
The Hacker News independently summarized the campaign and the Tencent fix.