China Hackers Exploit Sogou Input Method to Install GrayRabbit Backdoor

Introduction

Security researchers at Gen Digital have uncovered a sophisticated cyberattack campaign orchestrated by a China-linked threat actor group identified as UNC3569. The group exploited a previously unknown vulnerability in Sogou Input Method—one of the most widely adopted tools for typing Chinese characters on Windows operating systems. This zero-day exploit chain allowed attackers to deliver a powerful backdoor named GRAYRABBIT, effectively giving them the ability to perform any action the victim user could authorize. The discovery highlights how even seemingly innocuous software can become a critical attack vector when targeted by state-sponsored actors.

The attack sequence begins with a deceptively simple method: a malicious link distributed to potential victims. Once clicked, this link triggers a complex exploitation process that leverages the Sogou vulnerability to execute arbitrary code. This technique underscores the evolving nature of modern cyber threats, where attackers increasingly focus on supply chain compromises and legitimate software abuse rather than traditional phishing lures.

The Sogou Input Method Zero-Day Vulnerability

Sogou Input Method has maintained a dominant position in the Chinese language input market, with hundreds of millions of users relying on it daily for efficient Chinese character typing. Its deep integration with Windows systems makes it a prime target for attackers seeking initial access. The vulnerability exploited by UNC3569 appears to be a memory corruption issue that allows attackers to bypass security mechanisms and achieve remote code execution.

Key characteristics of this exploit include:

• Target: Sogou Input Method versions prior to patch
• Type: Zero-day vulnerability (unpatched at time of discovery)
• Impact: Remote code execution with user privileges
• Attack vector: Malicious URL triggering the vulnerability

Deployment of the GRAYRABBIT Backdoor

Once the Sogou vulnerability is triggered, UNC3569 deploys GRAYRABBIT—a custom-developed backdoor designed for persistent access and data exfiltration. Unlike commodity malware, GRAYRABBIT exhibits sophisticated evasion capabilities, including anti-analysis techniques and encrypted command-and-control communications.

The backdoor provides attackers with extensive capabilities:

• Full system reconnaissance and enumeration
• File system access and manipulation
• Network traffic interception and monitoring
• Credential harvesting and privilege escalation
• Support for additional modular payloads

Attack Sophistication and Stealth Techniques

What makes this campaign particularly concerning is the attackers' ability to chain multiple exploitation stages. Rather than relying on a single vulnerability, UNC3569 appears to have developed a multi-step attack process that maximizes success rates while minimizing detection chances. The use of a legitimate software platform for initial compromise allows malicious activity to blend seamlessly with normal user behavior.

Additional stealth measures observed in this campaign include:

• Legitimate process injection techniques
• Domain fronting for C2 communications
• Time-delayed payload execution
• Environmental awareness checks to avoid analysis environments

Broader Implications for Software Supply Chains

This incident serves as a stark reminder of the vulnerabilities inherent in popular software platforms. Even tools designed to improve user productivity can become entry points for sophisticated adversaries when security patches lag behind discovery. Organizations worldwide that use similar input methods or third-party software should reassess their vulnerability management strategies.

The attack also demonstrates the increasing convergence of cybercriminal tactics and nation-state capabilities. While the ultimate goal may be espionage or intelligence gathering, the methods employed mirror those seen in financially motivated attacks, blurring traditional threat actor boundaries.