Threat Actor 🇨🇳 China

UNC3569

China-nexus espionage actor that has been observed exploiting vulnerabilities in Aspera Faspex, Microsoft Exchange, and Oracle Web Applications Desktop Integrator, among others, to gain initial access to target environments.

MITRE ATT&CK TTPs 7

T1005
Data from Local System
Collection
 T1055
Process Injection
Defense Evasion
 T1059
Command and Scripting Interpreter
Execution
 T1071.001
Web Protocols
Command And Control
 T1082
System Information Discovery
Discovery
 T1087.001
Local Account
Discovery
 T1204.002
Malicious File
Execution

Source Articles

Hackers exploit Tencent app flaw to deploy GrayRabbit malware
Threat actors associated with the China-aligned UNC3569 group are actively exploiting a critical remote code execution vulnerability, CVE-2026-51990, in Tencent's Sogou Input Method for Windows to deploy the GrayRabbit backdoor. The attack chain begins with a maliciously crafted sgbiz: URI that triggers command-line argument injection, leading to unvalidated execution in the SGMyInput.exe process. This allows loading of an attacker-controlled URL in an outdated, unsandboxed Chromium-based webview, which then exploits known browser flaws to achieve code execution and deploy the modular GrayRabbit malware. The malware supports remote command execution, file transfers, reverse shells, and reflective plugin loading, with its C2 configuration RC4-encoded.
bleeping-computer ·3h ago