Threat Overview
Gen Digital research published September 10-11, 2026 described a live UNC3569 intrusion abusing the Windows version of Tencent Sogou Input Method. The chain used a crafted sgbiz: link to pass attacker-controlled arguments into Sogou components, opened attacker-controlled content through an outdated embedded Chromium path, and achieved code execution in the logged-in user’s context. The observed loader placed a legitimate 7-Zip binary, malicious 7z.dll, and an encrypted payload under C:\Users\Public\Documents, using DLL sideloading to launch the GRAYRABBIT backdoor. Observed C2 included mail.uaiubifas[.]top over TCP 443. Tencent fixed the disclosed link-handler issue in Sogou Input Method 16.3.0.3498.
References
- The Hacker News, September 11, 2026: China-linked UNC3569 exploited Sogou Input Method.
- Gen Digital research, published September 10, 2026, as cited in contemporaneous reporting.
Impacted Systems
Tencent Sogou Input Method for Windows. Relevant components include the custom sgbiz: protocol handler and embedded browser content path. CVE-2026-51990. The complete affected-version range was not confirmed in the reviewed public reporting. Version 16.3.0.3498 contains the disclosed link-handler fix. Victim interaction with a crafted link or equivalent delivery path is required. Observed follow-on activity included downloader execution, 7-Zip DLL sideloading, GRAYRABBIT deployment, and outbound C2.
Why this matters
The campaign turns a trusted input-method application into a code-execution path and leaves a remote-access backdoor. Organizations with Chinese-speaking users, regional operations, or Sogou deployments have direct exposure. The sideloading and C2 behaviors are also useful generic endpoint detections.
Exploitation Status
Confirmed observed exploitation in a live UNC3569 intrusion. Public reporting provides concrete infrastructure, file paths, process behavior, and malware hashes. No public victim count was confirmed.
What this hunt looks for
Published C2 and hashes, Sogou protocol/component execution, suspicious files under Public Documents, 7-Zip execution from the same location, unusual TCP 443 activity, rare destinations from Sogou or 7-Zip processes, and Windows process-creation fallbacks.
Required logs
Microsoft Defender XDR endpoint process, file, and network telemetry ingested into Sentinel. Windows Security Event 4688 can provide a process-creation fallback.
First Pass – Published Sogou / GRAYRABBIT Indicators
let Domains=dynamic(["mail.uaiubifas.top","noht1ng.top"]);
let IPs=dynamic(["8.218.50.207"]);
DeviceNetworkEvents
| where Timestamp >= ago(30d)
| where RemoteUrl in~ (Domains) or RemoteIP in (IPs)
| project Timestamp,DeviceName,InitiatingProcessAccountName,InitiatingProcessFileName,InitiatingProcessCommandLine,RemoteUrl,RemoteIP,RemotePort,Protocol
| order by Timestamp descPublished GRAYRABBIT and Loader Hashes
let Hashes=dynamic(["29c7ee41d0cc9e07d981e451df56d0c3d37c41ac4ec10c7b516cc033ee397a63","749160a2f20f82744026719cf72e483595c6aad718efa74d675a98662e02422e","d7a3c7eb94edc0e020f74c678743d71d61e944634aade4a67a96c3589e828b3a"]);
DeviceFileEvents
| where Timestamp >= ago(30d)
| where SHA256 in~ (Hashes)
| project Timestamp,DeviceName,ActionType,FileName,FolderPath,SHA256,InitiatingProcessFileName,InitiatingProcessCommandLine
| order by Timestamp descSogou Custom Protocol and Component Execution
DeviceProcessEvents
| where Timestamp >= ago(30d)
| where ProcessCommandLine has "sgbiz:" or FileName in~ ("biz_helper.exe","SGMyInput.exe")
| project Timestamp,DeviceName,AccountName,FileName,FolderPath,ProcessCommandLine,InitiatingProcessFileName,InitiatingProcessCommandLine
| order by Timestamp desc7-Zip Execution From Public Documents
DeviceProcessEvents
| where Timestamp >= ago(30d)
| where FileName in~ ("7z.exe","7za.exe","7zFM.exe")
| where FolderPath has @"\Users\Public\Documents"
| project Timestamp,DeviceName,AccountName,FileName,FolderPath,ProcessCommandLine,InitiatingProcessFileName,InitiatingProcessCommandLine,SHA256
| order by Timestamp descObserved Payload Files in Public Documents
DeviceFileEvents
| where Timestamp >= ago(30d)
| where FolderPath has @"\Users\Public\Documents"
| where FileName in~ ("7z.dll","p","core.dll")
| project Timestamp,DeviceName,ActionType,FileName,FolderPath,SHA256,InitiatingProcessFileName,InitiatingProcessCommandLine
| order by Timestamp descPublished C2 on TCP 443 From Non-Browser Processes
DeviceNetworkEvents
| where Timestamp >= ago(30d)
| where RemotePort == 443
| where RemoteUrl =~ "mail.uaiubifas.top" or RemoteIP == "8.218.50.207"
| where InitiatingProcessFileName !in~ ("chrome.exe","msedge.exe","firefox.exe","iexplore.exe")
| project Timestamp,DeviceName,InitiatingProcessFileName,InitiatingProcessCommandLine,RemoteUrl,RemoteIP,RemotePort,Protocol
| order by Timestamp descRare Network Destinations From Sogou or 7-Zip Processes
let Baseline=DeviceNetworkEvents
| where Timestamp between (ago(30d)..ago(2d))
| where InitiatingProcessFileName in~ ("biz_helper.exe","SGMyInput.exe","7z.exe","7za.exe","7zFM.exe")
| summarize by DeviceId,RemoteIP,RemotePort;
DeviceNetworkEvents
| where Timestamp >= ago(2d)
| where InitiatingProcessFileName in~ ("biz_helper.exe","SGMyInput.exe","7z.exe","7za.exe","7zFM.exe")
| join kind=leftanti Baseline on DeviceId,RemoteIP,RemotePort
| project Timestamp,DeviceName,InitiatingProcessFileName,InitiatingProcessCommandLine,RemoteIP,RemotePort,RemoteUrl
| order by Timestamp descSecurityEvent Fallback
SecurityEvent
| where TimeGenerated >= ago(30d)
| where EventID == 4688
| where ParentProcessName has_any ("biz_helper.exe","SGMyInput.exe","7z.exe","7za.exe","7zFM.exe")
| project TimeGenerated,Computer,Account,ParentProcessName,NewProcessName,CommandLine
| order by TimeGenerated descDetection Notes
The IOC queries are highest confidence but are not complete coverage because infrastructure can rotate. The Public Documents path and malicious 7z.dll behavior closely align with the observed chain. TCP 443 metadata alone cannot prove the reported non-TLS RC4 protocol. Sogou component activity may be legitimate where the software is common. Without endpoint process, file, and network telemetry, Sentinel visibility is materially reduced.
Killian Sherer 