China-Linked UNC3569 Exploits Sogou Input Method Flaw to Deploy GRAYRABBIT Backdoor

On September 11, 2026, security firm Gen Digital published research revealing that a China-linked hacking group, identified as UNC3569, exploited a flaw in Sogou Input Method to deploy a backdoor named GRAYRABBIT on targeted Windows systems. Sogou Input Method is one of the most widely used tools for typing Chinese characters, making it a high-value target for espionage campaigns.

The attack begins with a crafted link that, when clicked, triggers the vulnerability in the input method software. Successful exploitation leads to the installation of the GRAYRABBIT backdoor, which grants the attacker the ability to perform any action the logged-in user can do. This includes accessing files, capturing keystrokes, and potentially moving laterally within the network.

Gen Digital's report highlights the sophistication of the attack chain, though specific technical details of the vulnerability and the exploit are not fully disclosed. The company did not provide a CVE identifier for the flaw, and Tencent, which owns Sogou, has not yet released a patch or public advisory as of the publication date.

The campaign underscores the risks associated with widely deployed input method editors, which are often overlooked in security patching and monitoring. Organizations with Chinese-language users or operations in Chinese-speaking regions should be particularly vigilant.

While the exact scope of the campaign is unknown, the potential for full user compromise makes this a significant threat. Gen Digital's research provides indicators of compromise and detection guidance, but these details are not included in the public summary.

As of now, there is no evidence of exploitation in the wild beyond the reported campaign, but the severity of the impact warrants immediate attention from affected users and enterprises.