Sogou Input Method flaw was used to deliver the GRAYRABBIT backdoor

What happened

Gen Digital’s research says a China-linked group identified as UNC3569 exploited a vulnerability in Sogou Input Method, a Windows tool used to type Chinese characters, to install the GRAYRABBIT backdoor. The reported attack began with a crafted link. After exploitation, the attacker could act with the permissions of the logged-in Windows user.

That distinction is important: the available reporting establishes the access level described by the researchers, but it does not by itself show that every affected system received the same follow-on activity or that administrative control was automatically obtained.

Input-method software is easy to overlook during security reviews because it may be treated as a productivity utility rather than as a meaningful part of the attack surface. In this case, its presence on endpoints created a path from a user interaction to backdoor deployment.

Organizations that use the software, support Chinese-language input, or manage mixed-language Windows fleets should identify where it is installed and compare those systems with the relevant vendor and research guidance.

They should also review endpoint telemetry for suspicious link activity, unexpected process launches, and persistence associated with the reported intrusion, while avoiding assumptions that an absence of obvious symptoms proves no compromise occurred.