How a Single Link Opened a Backdoor Through the Sogou Keyboard for 455 Million Users

Gen Digital has published research into an attack chain that the China-linked group UNC3569 deployed against real-world victims. The starting point was a specially crafted URL, and the endgame was full control of the machine with the current user's privileges. Google has been tracking UNC3569 since 2021, ties it to China's “hackers-for-hire” scene, and notes attacks on the public sector, education, technology and finance across East and Southeast Asia.

The target was Sogou Input Method — the most popular way to type Chinese characters on Windows. According to Citizen Lab's 2023 figures, it has more than 455 million users per month and around 70% of the market; a notable share of its traffic also comes from outside China.

Three doors in a row

Sogou is not a single program but a set of components that talk to each other through their own sgbiz: link type. The biz_helper.exe handler checked which program was being asked to launch, but did not filter the arguments passed to it. The attacker pointed it at the SGMyInput.exe settings program and told it to open the “skin store” at an arbitrary address — the one screen that spawns a browser window.

And the browser here is a custom build of Chromium version 80, from around March 2020. Its code has the sandbox and the same-origin policy disabled outright. Without the sandbox, a JavaScript vulnerability turns into code execution on the user's machine, with no intermediate steps. The victim's page carried an exploit for CVE-2021-38003 — a flaw in how the V8 engine handles JSON.stringify, which Google patched back in Chrome 95 in October 2021. That fix, like most others, never made it into the Sogou build.

What was left on disk

The exploit pulled three files from a server in Alibaba Cloud (Hong Kong): a legitimate 7-Zip, a malicious DLL and an encrypted payload. The DLL replaced a library that 7-Zip loads at startup. Before decryption it counted the processes on the system: if there were fewer than 50 — a telltale sign of an analysis sandbox — the key was built incorrectly and the payload turned to garbage. The loader then hid itself in an NTFS alternate data stream and deleted itself, leaving no trace in the logs.

The end result was the GRAYRABBIT backdoor: a remote command shell, two-way file exchange and the loading of additional modules. It reached the command-and-control server over port 443, but the traffic there is plain TCP encrypted with RC4, not TLS.

A patch that didn't close everything

Gen reported the problem to Tencent on April 9, 2026 (CVE-2026-51990), and by April 21 the fix had gone out via auto-update in version 16.3.0.3498 — in 12 days. The fix is entirely within biz_helper.exe: it now requires HTTPS and checks the domain against a whitelist. But the engine itself was untouched — it is still Chromium 80 with the sandbox disabled.

Tencent considers the chain comparatively complex and insists that social engineering is required for the user to confirm the browser pop-up themselves. Gen counters that clicking the link was enough. Neither side specifies exactly what the victims saw. Neither Gen nor Tencent named the vulnerable versions or explained how to check an installed build.

Source: The Hacker News