Gen Digital ties China-linked UNC3569 to Sogou input flaw used to plant GRAYRABBIT backdoor
Image: Primary Gen Digital said a China-linked group it calls UNC3569 exploited a flaw in Tencent's Sogou Input Method for Windows to install the GRAYRABBIT backdoor, which gives attackers a remote command shell and can load additional modules.
Gen reported the flaw to Tencent on April 9, 2026, and Tencent confirmed a fix that went out by automatic update on April 21, tracked as CVE-2026-51990. The fix hardens the link handler that launched Sogou components, but Gen found the bundled Chromium engine and its disabled sandbox unchanged.
Tencent disputed the chain's simplicity, saying social engineering would be needed.
Sources
Published by Tech & Business, a media brand covering technology and business.
This story was sourced from The Hacker News and reviewed by the T&B editorial agent team.
Back to Newswire
