Security 1 publisher2 min readPublished September 11, 2026 at 1:09 AM PDT

UNC3569 exploited a Sogou Input Method link handler to run code as the user

Gen Digital found the chain while working a live UNC3569 intrusion. Tencent's April 2026 fix closed the link handler and left the bundled Chromium 80 in place, with its sandbox still switched off in the code.

The Watch · Security desk

Illustration accompanying UNC3569 exploited a Sogou Input Method link handler to run code as the user

What happened

Gen Digital said it found the flaw while investigating a live intrusion by UNC3569, a group Google Threat Intelligence ties to China and places in the country's hacker-for-hire scene.
The chain ran through sgbiz:, a link type registered on Windows whose handler biz_helper.exe checks which Sogou program a link names but applies no filtering to the arguments it passes on.
The crafted link started SGMyInput.exe, Sogou's settings program, and told it to open the skin store, the only screen there that opens a browser window, at an address of the attacker's choosing.
That browser is Sogou's own Chromium 80 build from around March 2020, with the sandbox and the same-origin policy switched off in the code, and the page served an exploit for CVE-2021-38003.
Tencent fixed the flaw in April 2026, and in the patched version Gen examined the built-in browser engine is still the 2020 version with its sandbox still off.

Compiled by The WatchSomething wrong?How this is made

Why it matters

capability No sandbox escape was needed. A 2021 V8 bug that is worthless against current Chrome is a complete code-execution tool against a host running Sogou Input Method.
exposure The skin store window still hands the unsandboxed engine any address it is given, so a second route to that window puts an attacker back at execution with the user's privileges.
decision Anyone running Chinese-language Windows fleets now has to weigh keeping an input method used by 455 million people a month against having a 2020 browser engine on the endpoint.
contradiction Gen and Tencent disagree over whether one click sufficed, and because neither disclosed what the victims were shown, any estimate of how much user interaction this chain needs rests on nothing public.

CVE-2021-38003 was fixed in Chrome 95 in October 2021 ^[26]. CISA added it to the catalog of vulnerabilities known to have been exploited on November 3, 2021 ^[27]. The engine inside Sogou Input Method is Chromium 80, built around March 2020 ^[18], roughly 19 months of Chrome releases before that fix landed ^[1]. Tencent shipped its fix in April 2026 ^[4], about 53 months after the KEV listing ^[2]. Because the engine is Sogou's own compiled copy, updating Chrome on the host does not touch it ^[4].

Gen says clicking the link was all it took ^[21]. Tencent, quoted in the research, described the chain as relatively complex and said an attacker would need social engineering to get the user to "actively authorize the browser's pop-up prompt" ^[22]. Chromium-based browsers do show a confirmation box before handing a link to a separate program on the machine, and a user can tick a box to stop seeing it for a given site ^[23]. Neither company says what the people in this campaign saw, and Gen says the link could also arrive by email or chat message, where neither account describes what the user is shown ^[24].

Citizen Lab at the University of Toronto called Sogou the most popular Chinese input method in China in 2023 research ^[10], and put its user base above 455 million people a month across Windows, Android and iOS, with about 70% of Chinese input-method users ^[11]. The same research cited market research on visits to the product's website and noted the United States accounted for over 3.3% of them ^[12]. That percentage counts website visits, not installations, so it yields no figure for a US installed base ^[5]. Citizen Lab also found encryption flaws in the app that exposed what people typed ^[13].

Gen's findings cover one product. The research does not address how other input methods or locale-specific desktop utilities are built, or whether organizations carry them in asset inventories ^[6]. Google has tracked UNC3569 since 2021 against government, education, technology and finance targets, mostly in East and Southeast Asia ^[6]. GRAYRABBIT, the backdoor placed here, gives an operator a remote command shell, moves files in both directions, and loads additional modules from the attacker's server at any time ^[8].

What to watch

Whether Tencent updates the bundled Chromium or enables its sandbox, and in which Sogou version.
Whether Gen or Google publishes indicators, victim counts, or further UNC3569 intrusions using this delivery path.
Whether other Sogou components reachable through sgbiz: accept arguments that reach a network-facing feature.

Claim ledger

Ranked by verification strength, evidence, and original report placement.

[1]
Gen Digital said in research published Thursday that a China-linked hacking group exploited a flaw in Sogou Input Method, one of the most widely used tools for typing Chinese characters on Windows, to install a backdoor on victims' computers.
ReportedSupportedView cited source
[3]
The attack started with a crafted link and ended with the attacker able to do anything the logged-in user could do.
ReportedSupportedView cited source
[4]
Tencent, which owns and develops Sogou, fixed the flaw in April 2026.
ReportedSupportedView cited source
[5]
Gen found the flaw while investigating a live intrusion by UNC3569, a group Google Threat Intelligence ties to China and places in the country's hacker-for-hire scene.
ReportedSupportedView cited source
[6]
Google has tracked UNC3569 since 2021 and says it has targeted government, education, technology, and finance sectors, mostly in East and Southeast Asia.
ReportedSupportedView cited source
[7]
The backdoor installed is GRAYRABBIT, a small program the group has used for years and that Google describes as its first step onto a machine.
ReportedSupportedView cited source
[8]
GRAYRABBIT gives an attacker a remote command shell, allows files to be moved in both directions, and can load additional modules from the attacker's server at any time.
ReportedSupportedView cited source
[9]
Tencent's fix blocked the way in but did not change the part of Sogou that made the attack possible; in the patched version Gen examined, the built-in browser engine is still the 2020 version and its sandbox is still switched off.
ReportedSupportedView cited source
[10]
Sogou Input Method is the most popular Chinese input method in China, according to 2023 research by Citizen Lab at the University of Toronto.
ReportedSupportedView cited source
[11]
Citizen Lab put Sogou's user base at more than 455 million people a month across Windows, Android and iOS, and its share of Chinese input-method users at about 70%.
ReportedSupportedView cited source
[12]
Citing market research on visits to the product's website, Citizen Lab noted that users are not only in China, with the United States accounting for over 3.3% of visits.
ReportedSupportedView cited source
[13]
The same Citizen Lab research found flaws in the app's encryption that exposed what people typed.
ReportedSupportedView cited source
[14]
On Windows, Sogou Input Method is a set of components that communicate via a custom link type registered on Windows, sgbiz:; when anything opens an sgbiz: link, Windows passes it to biz_helper.exe, which reads the link and starts the Sogou component it names.
ReportedSupportedView cited source
[15]
The handler checks which program the link asks it to start but does not check the command-line arguments the link asks it to pass along; Gen found no filtering on them at all.
ReportedSupportedView cited source
[16]
The link pointed at SGMyInput.exe, Sogou's settings program, and told it to open the skin store with a web address of the attacker's choosing.
ReportedSupportedView cited source
[17]
The skin store is the only screen in that program that opens a browser window, and the code sends that browser to whatever address it is handed, with no check on the address at all.
ReportedSupportedView cited source
[18]
Sogou builds its own copy of Chromium, and it is version 80, from around March 2020.
ReportedSupportedView cited source
[19]
Gen found two of the browser's protections switched off and written into the code that way: the sandbox and the same-origin policy.
ReportedSupportedView cited source
[20]
With the sandbox gone, a JavaScript flaw in the page becomes code that runs on the user's computer with the user's privileges, and there is no second step to exit the browser.
ReportedSupportedView cited source
[25]
The page the victims were sent to carried an exploit for CVE-2021-38003, a flaw in how V8, Chrome's JavaScript engine, handled JSON.stringify; it let an internal value that scripts should never see escape into the page, and from there an attacker could corrupt memory and run code.
ReportedSupportedView cited source
[26]
Google fixed CVE-2021-38003 in Chrome 95 in October 2021.
ReportedSupportedView cited source
[27]
CISA added CVE-2021-38003 to its catalog of vulnerabilities known to have been exploited on November 3, 2021.
ReportedSupportedView cited source
[d1]
Sogou's bundled Chromium 80 build predates the Chrome 95 fix for CVE-2021-38003 by roughly 19 months, so the fix was never present in that engine.
DerivedSupported1 source— sign in to open
[d2]
About 53 months separate CISA's known-exploited listing of CVE-2021-38003 and Tencent's fix for the Sogou chain.
DerivedSupported1 source— sign in to open
[d4]
Because the browser engine is Sogou's own compiled copy of Chromium, updating Chrome on the endpoint does not change it, and the patched build Gen examined still carried the 2020 engine.
DerivedSupported1 source— sign in to open
[d5]
The 3.3% United States figure is a share of visits to the product's website, not of installations, so it does not give a United States installed base for Sogou Input Method.
DerivedSupported1 source— sign in to open
[d6]
The reported findings are scoped to Sogou Input Method on Windows and contain no statements about how other input methods or locale-specific desktop utilities are built, or about whether organizations inventory them.
DerivedSupported1 source— sign in to open
[21]
Gen says clicking the link was all it took.
ReportedContested3 sources— sign in to open View cited source
[22]
Tencent described the chain as relatively complex and said an attacker would need social engineering to get the user to "actively authorize the browser's pop-up prompt."
ReportedContestedSource: Tencent, in a response quoted in Gen Digital's research3 sources— sign in to open View cited source
[23]
Browsers built on Chromium do show a confirmation box before handing a link to a separate program on the computer, and a user can tick a box to stop seeing it for a given site.
ReportedContested3 sources— sign in to open View cited source
[24]
Neither company says what the people in this campaign saw; Gen says the link could also arrive by email or chat message, and neither account says what a user sees when a link is opened that way.
ReportedContested3 sources— sign in to open View cited source

Sources

Publishers with included, body-backed reporting in this cluster.

thehackernews.com
1 article · September 11, 2026
China-Linked UNC3569 Exploited Sogou Input Method Flaw to Deploy GRAYRABBIT Backdoor

Ask Clarity

Have a question this piece left open? The answer comes from its reporting and claim ledger — nothing else.

Try

Clarity analysis

How the coverage leans and what the record actually supports. Read the methodology

Perspective Coverage

How much of the coverage speaks to builders, operators and investors. It measures emphasis, not whether the story is right.

The chain has three separate failures in it, and each one is the kind a developer signs off on without thinking. Sogou registers an sgbiz: link type on Windows; biz_helper.exe checks which Sogou binary a link names, then hands over the link's command-line arguments with no filtering, which Gen Digital says it found absent entirely. The settings program's skin store is the one screen that opens a browser window, and it sends that window to whatever address it receives. That window is Sogou's own compiled Chromium 80, from around March 2020, with the sandbox and the same-origin policy switched off in the code. Gen's point is that nothing needs to break out afterwards: a JavaScript bug in the page already runs with the user's privileges. The Hacker News is careful about the limit of its own count of unfixed V8 flaws, noting that whether any of them can be reached through that window depends on what the page can touch inside it, and that nobody has published that work.

Reality

Evidence, adoption, hype gap, incentives and confidence, each read independently from the current record on the scale shown beneath it. How these are measured.

Evidence68

0100

One vendor's teardown, partly checkable

The technical spine is specific enough to verify: a named handler binary, a named settings program, a named engine version, two named protections disabled in code. Anyone with the shipped Windows package can look. The Hacker News did part of that work itself, matching the 41 V8 flaws in CISA's catalog against Sogou's Chromium version. What has no second source is the intrusion: the victims, their number and their sectors come from Gen Digital alone, with Google Threat Intelligence's attribution and Citizen Lab's user figures both relayed second-hand.

Adoption74

0100

Enormous install base, half-closed fix

Reach is the least uncertain part of this story. Citizen Lab counted more than 455 million monthly users and about 70% of Chinese input-method users in 2023. A fix exists and is dated April 2026, and it changes the link handler. Gen found the chain in production, inside an intrusion it was already working. What nobody reports is uptake of the patch, or how many of those installs sit on managed Windows machines rather than personal ones.

Hype gap+8

−100 understated0 aligned+100 overstated

Close to the evidence, with one disputed click

The write-up mostly stays inside what was shown, and where it does not, it says so. Two places run ahead. Gen's "clicking the link was all it took" is a vendor characterisation that Tencent rejects, and no one has described what the pop-up looked like to the people who were hit. And the count of unfixed V8 flaws in Sogou's engine is a count of CVE records, which The Hacker News marks as separate from the question of whether any of them can be reached through the skin store window.

Incentives62

0100

Vendor research against vendor response

Gen Digital sells security software and found this during paid incident work, so the research is also a shop window. Tencent's answer, that the chain is relatively complex and needs social engineering, is what a vendor says once a fix has shipped and an architectural choice has not changed. Google Threat Intelligence supplies the group name, and Citizen Lab's user numbers come from research that had already faulted Sogou's encryption. Every party quoted has a reason to size this the way it does.

Confidence63

0100

Firm on the binary, thin on the campaign

One newsroom read one vendor's research, and the central question in it is contested. The claims that would survive independent checking are the ones sitting in a shipped file: the engine version, the two disabled protections, the unfiltered arguments. The campaign's size, its victims and what they saw on screen have no second source, and the interval between CISA listing CVE-2021-38003 in November 2021 and Tencent's April 2026 fix is arithmetic on dates the reporting supplies.

Topics and entities

Follow any of these and your For You feed starts watching them — no settings page required.

Topics

security
CISA orders Ray patched as RondoDox folds cluster software into a 174-exploit arsenal
1 publisher
security
Whoever holds a LiteLLM master key reads every provider key and the host's IAM credentials
1 publisher
security
CISA asks buyers to make eliminated vulnerability classes a contract condition
1 publisher
security
CISA's KEV clock now runs on BOD 26-04, and your patch SLA cites the wrong directive
2 publishers

UNC3569 exploited a Sogou Input Method link handler to run code as the user

What happened

Why it matters

What to watch

Claim ledger

Sources

Topics and entities

Topics

Entities

Claim ledger

Sources

Topics and entities

Topics

Entities

Perspective Coverage

Reality

What happened

Why it matters

What to watch

Claim ledger

Sources

Let Clarity write the post for you.

Topics and entities

Topics

Entities

Related stories

Claim ledger

Sources

Let Clarity write the post for you.

Topics and entities

Topics

Entities

Related stories

Perspective Coverage

Reality