Malware

GRAYRABBIT

According to Mandiant, GRAYRABBIT is a lightweight and simple backdoor that supports simple file operation, system information collection, running modularized plugins, and executing a remote command shell.

MITRE ATT&CK TTPs 7

T1005
Data from Local System
Collection
 T1055
Process Injection
Defense Evasion
 T1059
Command and Scripting Interpreter
Execution
 T1071.001
Web Protocols
Command And Control
 T1082
System Information Discovery
Discovery
 T1087.001
Local Account
Discovery
 T1204.002
Malicious File
Execution

Source Articles

Hackers exploit Tencent app flaw to deploy GrayRabbit malware
Threat actors associated with the China-aligned UNC3569 group are actively exploiting a critical remote code execution vulnerability, CVE-2026-51990, in Tencent's Sogou Input Method for Windows to deploy the GrayRabbit backdoor. The attack chain begins with a maliciously crafted sgbiz: URI that triggers command-line argument injection, leading to unvalidated execution in the SGMyInput.exe process. This allows loading of an attacker-controlled URL in an outdated, unsandboxed Chromium-based webview, which then exploits known browser flaws to achieve code execution and deploy the modular GrayRabbit malware. The malware supports remote command execution, file transfers, reverse shells, and reflective plugin loading, with its C2 configuration RC4-encoded.
bleeping-computer ·3h ago