China-linked UNC3569 Exploits Sogou Input Method to Deploy GRAYRABBIT Backdoor

BEIJING — A hacking group linked to China known as UNC3569 has exploited a vulnerability in the widely used Sogou Input Method software to install the GRAYRABBIT backdoor on targeted computers, granting attackers remote command shell access. The campaign, detected on Sept. 11, 2026, primarily targets organizations across East and Southeast Asia, with a significant concentration of activity originating from within China.

The attack leverages a flaw in the Sogou Input Method, a popular text entry tool used by millions of Chinese-speaking users to type characters efficiently. By compromising this legitimate software, UNC3569 was able to bypass standard security measures and silently deploy the GRAYRABBIT malware. Once installed, the backdoor provides attackers with persistent control over infected systems, allowing them to execute arbitrary commands, steal data, and potentially move laterally within victim networks.

Security researchers identified the intrusion as part of a broader effort to gain unauthorized access to sensitive information held by government agencies, defense contractors, and technology firms in the region. The GRAYRABBIT backdoor is designed to maintain a low profile, evading detection by traditional antivirus solutions while establishing a command-and-control channel for remote operators.

The scope of the operation appears focused on specific sectors within East and Southeast Asia, suggesting a strategic intent rather than random opportunistic hacking. While the exact number of compromised systems remains unconfirmed, initial indicators point to a coordinated effort affecting multiple high-value targets. The exploitation of Sogou Input Method is particularly concerning given the software's deep integration into daily workflows in Chinese-language environments.

UNC3569 has previously been associated with state-sponsored cyber espionage activities, though no official attribution has been made by national governments regarding this specific incident. The group's use of supply chain compromises through popular consumer software marks a shift in tactics, moving away from direct network intrusions toward exploiting trusted applications.

Cybersecurity firms have begun issuing alerts to affected organizations, urging immediate patching of the Sogou Input Method vulnerability and scanning for signs of GRAYRABBIT infection. However, the full extent of the data exfiltration remains unknown, and it is unclear whether the attackers have maintained access since the initial discovery.

Questions remain regarding the specific objectives of UNC3569 in this campaign and whether other input method software or similar platforms are vulnerable to the same exploit. As investigators work to trace the origin of the attack code and identify all compromised systems, the incident underscores the growing risks associated with supply chain vulnerabilities in widely distributed software.

The situation continues to develop as more details emerge about the scale of the breach and the potential impact on regional cybersecurity infrastructure.