A China-aligned cyber espionage group tracked as UNC3569 weaponized an unpatched zero-day vulnerability in Sogou Input Method, China's dominant Chinese-character typing utility with over 455 million monthly active users, to compromise Windows endpoints and install the GRAYRABBIT backdoor.

The campaign was discovered in live enterprise intrusions and documented by security researchers at Gen Digital. Tencent, which owns and maintains the Sogou suite, released an update to restrict the delivery path, but architectural risks persist on hundreds of millions of workstations.

Protocol Handler Exploitation via sgbiz:

Sogou Input Method on Windows operates as a distributed collection of local utilities that coordinate via a proprietary URI protocol handler registered during installation: sgbiz:. When any desktop browser, email client, or application encounters an sgbiz: link, Windows automatically routes the parameter to Sogou’s local helper binary, biz_helper.exe.

Researchers discovered two compounding flaws in how biz_helper.exe processed external instructions:

  1. Unfiltered Command-Line Arguments: While biz_helper.exe verified which Sogou program the URL attempted to launch, it performed zero validation or sanitization on the command-line arguments passed alongside the invocation.
  2. Legacy Chromium Engine Without Sandbox: One of the callable sub-components was an internal web-view renderer running an outdated 2020 Chromium build. Crucially, Sogou configured this renderer with the Chromium sandbox explicitly turned off (--no-sandbox).

By crafting an sgbiz: URL that launched the un-sandboxed browser against an attacker-controlled HTML page hosting a Chromium exploit, UNC3569 achieved seamless arbitrary code execution at the privilege level of the logged-in user.

The GRAYRABBIT Backdoor

Once code execution was achieved, the threat actors deployed GRAYRABBIT, a compact C/C++ implant historically associated with Chinese state-contracted operators. GRAYRABBIT provides operators with:

  • An interactive, encrypted reverse command shell terminating at external bulletproof hosting providers.
  • Bidirectional file transfer functionality to exfiltrate sensitive documents and stage secondary reconnaissance tools.
  • Dynamic memory injection capabilities to load additional malicious DLL modules directly into legitimate Windows system processes.

Sogou accounts for roughly 70% of Chinese input method users globally, with significant enterprise adoption across international corporations, embassies, and financial institutions handling Asian market transactions.

Remediation & Defense Advice

Organizations whose staff utilize Sogou Input Method should execute immediate containment measures:

  • Upgrade Sogou IME Immediately: Ensure all Windows endpoints run the latest release from Tencent.
  • Disable the sgbiz: Protocol Handler: Enterprise administrators can neutralize the attack surface across managed fleets by deleting the HKEY_CLASSES_ROOT\sgbiz registry key via Group Policy.
  • Audit Endpoint Process Trees: Hunt for instances of biz_helper.exe spawning network connections or child shells (cmd.exe, powershell.exe).