Loading story…
China-linked threat actor UNC3569 actively exploited critical remote-code-execution flaw CVE-2026-51990 in Tencent Sogou Input Method for Windows to install the GRAYRABBIT backdoor. Victims could be compromised through a crafted sgbiz: link that injected attacker-controlled arguments, opened Sogou's Skin Center CEF webview at a malicious site, and exploited the Chromium V8 vulnerability CVE-2021-38003 to execute code in the logged-in user's context.
Tencent released Sogou Input Method version 16.3.0.3498 through automatic updates, adding validation for URL-bearing protocol-handler arguments. However, researchers reported that the application continues to embed Chromium 80 with its sandbox and web-security/same-origin protections disabled. GRAYRABBIT used 7-Zip DLL sideloading, anti-analysis and self-deletion measures, and RC4-obfuscated non-TLS command-and-control traffic over TCP port 443.
See which actors are running it and whether you're in range.
8 events from the most recent confirmed update back to the earliest known activity.
As of September 10, 2026, Sogou Input Method reportedly still used the outdated Chromium 80 component with its sandbox disabled and key web protections removed. Tencent's version 16.3.0.3498 update fixed the protocol-handler issue but reportedly did not update the underlying Chromium version or configuration.
MITRE assigned identifier CVE-2026-51990 to the critical Sogou Input Method remote-code-execution vulnerability chain.
Tencent deployed an automatic-update fix in Sogou Input Method version 16.3.0.3498. The patch added HTTPS and hostname-suffix allowlisting for URL-bearing arguments handled by biz_helper.exe.
Tencent acknowledged Gen Threat Labs' vulnerability report concerning the Sogou Input Method flaw.
Gen Threat Labs reported the critical Sogou Input Method remote-code-execution chain to Tencent.
CISA added the Chrome V8 vulnerability CVE-2021-38003 to its Known Exploited Vulnerabilities Catalog.
Google patched the V8 type-confusion vulnerability CVE-2021-38003 in Chrome 95. Sogou Input Method's embedded Chromium 80 component did not receive this fix.
PRC-linked UNC3569 actively exploited the Sogou Input Method vulnerability later assigned CVE-2026-51990. Crafted sgbiz: links opened an attacker-controlled page in Sogou's insecure Chromium 80 webview, which exploited CVE-2021-38003 to deliver the GRAYRABBIT backdoor through 7-Zip DLL sideloading.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
6 references tracked. Mallory keeps watching after this page renders.
cryptika.com
Open sourcesecurityweek.com
Open sourcecysecurity.news
Open sourcethehackernews.com
Open sourcegendigital.com
Open sourcecisa.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple security firms reported ongoing campaigns targeting Chinese-speaking Windows users with fake or trojanized installers for popular software, including **Google Chrome**, **Microsoft Teams**, **Surfshark**, **Signal**, **Telegram**, **Zoom**, **DeepSeek**, **Quark Cloud**, and activation tools. The attacks rely on spoofed download sites and malicious `MSI` or `NSIS` packages that decrypt payloads in memory and ultimately deploy remote-access malware tied to the **Gh0st RAT** ecosystem, including modified Gh0st variants and **Atlas RAT**. Researchers linked the activity to Chinese-speaking threat actors including **Dragon Breath** and **Silver Fox**, noting refreshed infrastructure, low detection rates, and lures designed to appear legitimate, in some cases using AI-generated web pages and valid code-signing certificates. The intrusion chains emphasize defense evasion before full payload delivery. Reported techniques include abuse of signed or vulnerable kernel drivers to terminate or disable more than 200 security products, unsigned `WDAC` policies to block Chinese antivirus tools, **Protected Process Light** abuse to corrupt **Microsoft Defender**'s `MsMpEng.exe`, phantom DLL side-loading, thread-pool-based process injection, in-memory reflective loading, and persistence through services, scheduled tasks, and watchdog scripts. Once installed, the malware supports encrypted command-and-control, command execution, keylogging, clipboard theft, active-window logging, RDP session hijacking, and additional payload delivery, underscoring a sustained pattern of installer-based malware operations aimed at users seeking trusted software from unofficial sources.
Aug 14, 2026
Trend Micro reported on **PeckBirdy**, a lightweight **JScript-based command-and-control (C2) framework** used since at least 2023 by **China-aligned** threat actors to reduce on-disk artifacts and evade detection by leveraging Windows Script Host and runtime-injected code. The activity was tied to two intrusion sets/campaigns, **SHADOW-VOID-044** and **SHADOW-EARTH-045**, with victimology including Asian government entities, education, and the Chinese gambling sector. The framework was observed operating alongside modular backdoors **HOLODONUT** and **MKDOOR**, and in at least one campaign with commodity tooling such as **Cobalt Strike** and the use of **stolen code-signing certificates**. Trend Micro’s analysis linked SHADOW-VOID-044 infrastructure and tooling to previously reported China-aligned activity, including overlap with **UNC3569** (e.g., shared C2 domain `center[.]myrnicrosoft[.]com` and targeting of the Chinese gambling industry) and hosting of a variant of the **GRAYRABBIT** backdoor that used DLL sideloading and PowerShell execution via `UuidFromStringA`. Additional infrastructure overlaps were noted with activity associated with **TheWizard** (e.g., HOLODONUT samples communicating with `mkdmcdn[.]com`). Reported infrastructure and artifacts included IP `47[.]238[.]219[.]111`, domains `center[.]myrnicrosoft[.]com`, `mkdmcdn[.]com`, and a Cobalt Strike payload with SHA-256 `162cc325ab7b6e70edb6f4d0bc0e52130c56903f`.
Jun 29, 2026
Binary Defense disclosed a newly identified Go-based Windows backdoor, **BLUERABBIT**, that provides attackers with persistent access, reconnaissance, screenshot and screen-recording capture, shell execution, and data theft before escalating to file encryption and destructive wiping. The malware is assessed as likely tied to an **Iran-nexus** activity cluster and appears primarily aimed at organizations in **Israel**. Researchers said BLUERABBIT was first observed in mid-to-late March 2026 and linked it to activity associated with **BLUEWIPE** and **SEWERGOO**. BLUERABBIT blends into enterprise environments by using **RabbitMQ** over **AMQP** for command-and-control, **Redis** for task state management, and **MinIO** for S3-compatible exfiltration. It persists through a scheduled task named **"OneDrive Update"**, stores staging data under `HKCU\Software\OneDrive`, can encrypt files with the `.candy` extension, and includes two wiping routines that disable Windows recovery mechanisms and alter boot-file permissions to make systems unrecoverable. Detection opportunities include anomalous AMQP traffic from workstations, suspicious MinIO client execution, unusual GUID-like staging folders, the fake OneDrive task, and unauthorized use of tools such as `takeown` or `icacls` against critical boot files.
Jun 29, 2026