China-Linked UNC3569 Exploited Sogou Input Method Flaw to Deploy GRAYRABBIT Backdoor

A China-linked hacking group exploited a flaw in Sogou Input Method, one of the most widely used tools for typing Chinese characters on Windows, to install a backdoor on victims' computers, security company Gen Digital said in research published Thursday. The attack started with a crafted link and ended with the attacker able to do anything the logged-in user could do. Tencent, which owns

Reported facts: A China-linked threat group UNC3569 exploited a vulnerability in the widely used Sogou Input Method for Windows to deploy the GRAYRABBIT backdoor, ultimately gaining the same level of access as the logged-in user. This illustrates how compromising a third-party software component in the stack can provide broad system control. RealGround analysis: For organizations integrating third-party input methods, keyboard tools, or similar software into AI-enabled workflows or agent environments, this highlights the need to treat such components as part of the AI supply chain, with rigorous SBOM, patching, and dependency risk management to prevent backdoor installation and privilege misuse through compromised upstream tools.