1. Basic Information Original Title: Hackers exploit Tencent app flaw to deploy GrayRabbit malware Source: BleepingComputer, Gen Threat Labs Published: 2026-09-13 Severity: Critical Reason for Severity: Active exploitation has been confirmed where a widely used Windows Chinese input method executes code via a crafted link, allowing UNC3569 to deploy the GRAYRABBIT backdoor. Reference: Hackers exploit Tencent app flaw to deploy GrayRabbit malware Related Source: Gen Threat Labs: Gray Rabbits and the Tale of a One-Click Backdoor Related CVE: CVE-2026-51990, CVE-2021-38003 Affected Product: Tencent Sogou Input Method for Windows 2. Executive Summary UNC3569 chained a custom URI handler in Sogou Input Method, a WebView that permits external URLs, and an outdated sandboxless Chromium instance to execute the GRAYRABBIT backdoor starting from a single link. Update to version 16.3.0.3498 or later, and investigate known files, network traffic, and process lineages. 3. Attack Flow Flow 1: Deploying GRAYRABBIT via an sgbiz: Link UNC3569 sends a crafted sgbiz: link containing an attacker-controlled URL as an argument to the victim. When the victim opens the link, Windows launches biz_helper.exe. Gen Threat Labs states this succeeds in one click, while Tencent states user permission via a browser pop-up is required; exact display conditions cannot be confirmed from public information. biz_helper.exe passes the unvalidated param to the legitimate SGMyInput.exe, specifying -page=skincenter and an attacker-controlled -url. SGWebRender.exe opens the attack page using Chromium 80 with the sandbox and same-origin policy disabled. The attack page exploits CVE-2021-38003 to achieve arbitrary V8 read and write, placing a downloader into the executable region of WebAssembly to run it. The downloader saves a legitimate 7z.exe, a modified DLL, and an encrypted payload to C:\Users\Public\Documents\, executing the loader via DLL sideloading. The loader performs analysis environment checks using the process count, decrypts and executes in memory, self-deletes using an alternate data stream, and reflectively loads GRAYRABBIT. GRAYRABBIT connects to the C2 server, accepting command execution, an interactive shell, file transfer, system information collection, and in-memory loading of additional plugins. 4. Attacker Position and Execution Location The initial position is an external attacker capable of delivering a crafted link to the victim. Initial code execution occurs within the outdated Chromium instance inside SGWebRender.exe bundled with Sogou Input Method, inheriting the current user privileges. - Subsequent execution uses 7z.exe and the fake 7z.dll stored in C:\Users\Public\Documents\, with GRAYRABBIT loaded into memory. 5. Victim and Administrator Perspective Victim The attack starts by clicking an sgbiz: link. Tencent states browser pop-up permission is required. Meanwhile, researchers state it is a one-click action without additional steps; actual displays may depend on the version and caller. The downloader launches the legitimate 7z.exe with CREATE_NO_WINDOW, so subsequent execution may not appear on the screen. Administrator An abnormal process chain from biz_helper.exe to SGMyInput.exe, SGWebRender.exe, and 7z.exe. 7z.exe, a fake 7z.dll, and an encrypted payload created in C:\Users\Public\Documents\. Raw TCP communication over port 443/TCP to mail.uaiubifas[.]top. This is not HTTPS, but raw TCP communication encrypted with RC4 using fixed-length 4096-byte frames. The loader renames the fake DLL to an alternate data stream and deletes it, meaning files may not remain. 6. Success and Failure Conditions Success Conditions A vulnerable Sogou Input Method is installed and the sgbiz: handler is available. The victim opens the crafted link. If following Tencent's explanation, browser pop-up permission is also granted. The attacker-controlled page and staging destination are reachable, and the V8 exploit against the outdated Chromium succeeds. Subsequent files can be saved and executed with current user privileges. Failure Conditions In version 16.3.0.3498 and later, biz_helper.exe validates -url and -firsturl, restricting them to HTTPS and permitted Sogou and Tencent domains, blocking the observed external URL path. Inference: Blocking external sgbiz: link launches via email, chat, browsers, or EDR stops the chain initiated by user action. Inference: Blocking connections to known domains and IPs, suspicious 7-Zip deployment under Public Documents, and abnormal child processes from Sogou processes can stop subsequent deployment. 7. What Happens Upon Success The V8 exploit executes code with current user privileges. A fake DLL is sideloaded into legitimate 7-Zip to load GRAYRABBIT into memory. The backdoor can execute processes, provide an interactive shell, send and receive files, collect host information, and load additional plugins. Public information confirms backdoor deployment, but does not indicate the scope of data stolen or subsequent actions in specific victim organizations. 8. Observable Logs Email Inference: If delivered via email, the sgbiz: scheme or an -url argument with multiple layers of URL encoding may remain in body, attachment, or URL rewrite logs. The delivery path is not public. Proxy / SWG / DNS Confirm the retrieval of the attack page from noht1ng[.]top and three files from 8.218.50[.]207. Confirm name resolution for mail.uaiubifas[.]top in DNS logs. HTTPS decryption logs alone cannot verify raw TCP C2 contents. Endpoint / EDR Confirm the chain of biz_helper.exe → SGMyInput.exe → SGWebRender.exe along with arguments -page=skincenter -url=.... Confirm file creation from SGWebRender.exe or execution of C:\Users\Public\Documents\7z.exe loading 7z.dll from the same directory. Public SHA-256 hashes are 29c7ee41d0cc9e07d981e451df56d0c3d37c41ac4ec10c7b516cc033ee397a63 for the fake 7z.dll, 749160a2f20f82744026719cf72e483595c6aad718efa74d675a98662e02422e for the encrypted payload, and d7a3c7eb94edc0e020f74c678743d71d61e944634aade4a67a96c3589e828b3a for GRAYRABBIT. Confirm in-memory execution using CreateThreadpoolWork, RWX memory, and the renaming/deletion of the fake DLL via alternate data streams. API names alone do not confirm malice. Identity / IdP Enterprise IdP authentication is not mandatory for the initial establishment of this attack. Inference: If credentials or sessions are abused after backdoor execution, correlate endpoint timelines with authentication from unknown sources and endpoints. SaaS / Cloud Subsequent compromise of SaaS or cloud environments is not confirmed from public information. Inference: If the target endpoint accessed management SaaS or cloud environments, confirm management operations and token usage after backdoor execution. Network Confirm raw TCP connections to mail.uaiubifas[.]top:443, 4096-byte frames, and reconnection approximately 10 seconds after disconnection. Do not assume TLS communication based solely on the use of port 443/TCP; verify the presence of a TLS handshake. 9. Attack Success Determination The following outlines the scope confirmed in public information and the criteria used in organizational investigations: Verify User Action: Public Info: Gen Threat Labs confirmed intrusion using a crafted sgbiz: link. Tencent states browser pop-up permission is also required. Verify Initial Execution: Public Info: The attack page exploited CVE-2021-38003, proceeding from the downloader to 7-Zip DLL sideloading. Verify Malware Execution or Auth Success: Public Info: Gen Threat Labs confirmed the deployment of the GRAYRABBIT backdoor by UNC3569. This does not imply successful authentication. Verify Data Theft or Session Compromise: Criteria: When data exfiltration or session abuse is substantiated via C2 frames, file transmission, or external service audit logs. Public info has not confirmed the scope of individual victims. Verify Subsequent Compromise: Criteria: When additional commands, plugins, lateral movement, or account operations via the backdoor are substantiated by endpoint, network, and authentication logs. The scope is not indicated in public info. 10. Investigation Playbook Trigger Launch of sgbiz: links, external URL connections from Sogou processes, known IOCs, and suspicious 7-Zip execution under Public Documents. Initial Verification Check the Sogou Input Method version, installation endpoint, update time, sgbiz: handler registration, and endpoint user. Preserve EDR, DNS, Proxy/SWG, Firewall, email/chat, Windows Event, and IdP logs. Endpoint / Server Verify parent-child relationships, arguments, signatures, and execution times for biz_helper.exe, SGMyInput.exe, SGWebRender.exe, and 7z.exe. Inspect creation and deletion history in C:\Users\Public\Documents\, loading of the fake 7z.dll, matching public SHA-256 hashes, and signs of RWX memory and reflective loading. Even if files are deleted, check acquired evidence such as MFT, USN Journal, EDR telemetry, Prefetch, and Amcache. Authentication / Cloud Verify sources of browser sessions, tokens, VPNs, SaaS, cloud services, and administrative account usage after the backdoor execution time. Subsequent Operations Track interactive cmd usage, additional processes, file send/receive, plugin loading, external connections, credential access, and lateral movement chronologically. Containment Inference: Network-isolate endpoints where compromise is confirmed, or endpoints strongly suspected of compromise based on execution and communication evidence. Update endpoints using vulnerable Sogou Input Methods to version 16.3.0.3498 or later, and verify that the update has been applied to each endpoint. Block known IOCs and revoke/reissue critical credentials and sessions used on compromised endpoints. Do not consider containment complete solely through system reboots or file deletions; verify in-memory execution and subsequent operations. Decision Categories Distinguish between link reach, user action, V8 exploit, downloader execution, GRAYRABBIT execution, and data exfiltration/subsequent compromise. 11. Defense and Detection Ideas Single Event External sgbiz: launch containing -page=skincenter and an external -url argument. Creation of executables or DLLs from the Sogou renderer process to C:\Users\Public\Documents\. 7z.exe under Public Documents loading an unsigned or hash-mismatched 7z.dll from the same directory. Chronological Correlation Correlate sgbiz: launch -> attack domain connection -> creation of three files -> 7z.exe execution -> connection to mail.uaiubifas[.]top:443. Correlate fake DLL creation -> renaming to alternate data stream -> deletion -> RWX memory execution. Hunting Inventory endpoints with Sogou Input Method installed, and review history beyond known IOCs for Sogou processes connecting to unapproved domains. Investigate 7-Zip executed from C:\Users\Public\Documents\ and the loading of DLLs from the same directory by signed executables. Log Gaps Without process arguments, DLL loading, file deletion, DNS, and raw TCP flows, determining initial execution and C2 success is difficult. The automated rollout time of the patched version does not determine the exact time updates completed on each endpoint. Priority Countermeasures Prioritize updating to version 16.3.0.3498 or later and verifying versions across installed endpoints. Inference: Restrict sgbiz: protocol execution on endpoints where it is unnecessary for business, and limit outbound communications of Sogou-related processes to necessary destinations. Even in the patched version, CEF 80, disabled sandboxes, and weak web security settings remain; continue monitoring unapproved URL paths and product updates. 12. Facts / Inference / Hypothesis Facts Gen Threat Labs confirmed an intrusion where UNC3569 actively exploited CVE-2026-51990 to deploy GRAYRABBIT. The attack chains unvalidated arguments of the sgbiz: handler, unlimited URL navigation in the SkinCenter WebView, and known V8 vulnerabilities and disabled sandboxes in Chromium 80. The observed attack page exploited CVE-2021-38003 to execute a 921-byte x64 downloader. The downloader retrieved the legitimate 7z.exe, a fake 7z.dll, and an encrypted payload, proceeding to GRAYRABBIT via DLL sideloading. GRAYRABBIT uses raw TCP over port 443/TCP, encrypting each 4096-byte frame with a fixed RC4 key. Tencent distributed version 16.3.0.3498 on April 21, 2026, adding validation for HTTPS and permitted domains to arguments accepting external URLs. The patched version maintains settings such as the bundled CEF version, disabled sandbox, and disable-web-security. Inference Japanese organizations, overseas branches, and contractors with Chinese input environments might overlook outdated embedded Chromium instances through standard browser asset management alone. Since known IOCs are subject to change, detection is required that combines outbound URL navigation of Sogou processes, DLL sideloading, and raw TCP C2. Hypothesis No additional hypotheses. Unverified items are documented in "Unknowns and Additional Investigation". 13. MITRE ATT&CK Mapping T1204.001 User Execution: Malicious Link (Confidence: high): The attack begins when a victim opens a crafted sgbiz: link. T1203 Exploitation for Client Execution (Confidence: high): Exploits CVE-2021-38003 on embedded Chromium to execute shellcode with user privileges. T1105 Ingress Tool Transfer (Confidence: high): Retrieves legitimate executables, fake DLLs, and encrypted payloads from a staging server. T1574.001 Hijack Execution Flow: DLL (Confidence: high): Causes legitimate 7z.exe to load a fake 7z.dll. T1620 Reflective Code Loading (Confidence: high): Maps and executes GRAYRABBIT and additional plugins directly in memory. T1095 Non-Application Layer Protocol (Confidence: high): Uses a custom raw TCP C2 protocol without TLS over port 443/TCP. T1070.004 Indicator Removal: File Deletion (Confidence: high): The loader self-erases using alternate data stream renaming and deletion specification. 14. Unknowns and Additional Investigation Number of victim organizations, industry sectors, regions, timing of intrusion, and initial delivery vector. Exact conditions for displaying the browser pop-up described by Tencent and the discrepancy with the research observation environment defined as one-click. GRAYRABBIT commands, additional plugins, data theft, and lateral movement executed in individual victim environments. The timestamp when automated updates for version 16.3.0.3498 were applied to all deployed endpoints and how to verify this in management environments. Product-side plans to update and reconfigure legacy CEF and disabled web security features. 15. Impact on SOCs and Organizations When using Sogou Input Method in branch offices or business partners in mainland China, or on Chinese input terminals in Japan, it is necessary to track the embedded Chromium and custom URI handlers bundled with the product as assets, separate from standard Chrome or Edge version management. While the patched version blocks observed external URL paths, legacy CEF and weak execution settings remain; therefore, monitor outbound communications and DLL loads of Sogou processes in addition to version checks. Even without matching known IOCs, prioritize investigating chains leading from sgbiz: to execution under Public Documents and 443/TCP communications lacking TLS. 16. Summary by Role SOC: Chronologically correlate sgbiz: execution, Sogou process external connections, 7-Zip and fake DLLs under Public Documents, and TLS-less 443/TCP. Administrators: Update Sogou Input Method to version 16.3.0.3498 or later and verify that the update has been applied to each endpoint. Restrict custom URI launches and outbound communications unnecessary for business. Users: Do not permit unfamiliar sgbiz: links presented in emails, chat, or web pages, or Sogou-related browser pop-ups, and report them to the SOC.