bleeping-computer Sep 13, 2026 · Crawled Sep 13, 2026

Hackers exploit Tencent app flaw to deploy GrayRabbit malware

1 Actors 1 Malware

AI Summary

Threat actors associated with the China-aligned UNC3569 group are actively exploiting a critical remote code execution vulnerability, CVE-2026-51990, in Tencent's Sogou Input Method for Windows to deploy the GrayRabbit backdoor. The attack chain begins with a maliciously crafted sgbiz: URI that triggers command-line argument injection, leading to unvalidated execution in the SGMyInput.exe process. This allows loading of an attacker-controlled URL in an outdated, unsandboxed Chromium-based webview, which then exploits known browser flaws to achieve code execution and deploy the modular GrayRabbit malware. The malware supports remote command execution, file transfers, reverse shells, and reflective plugin loading, with its C2 configuration RC4-encoded.

AI-extracted · verify before operational use

Extracted Entities 2 found

Threat Actor UNC3569 → Malware GRAYRABBIT →

MITRE ATT&CK TTPs 7 techniques

T1005 Data from Local System · Collection T1055 Process Injection · Defense Evasion T1059 Command and Scripting Interpreter · Execution T1071.001 Web Protocols · Command And Control T1082 System Information Discovery · Discovery T1087.001 Local Account · Discovery T1204.002 Malicious File · Execution