🚨 In-the-wild zero-day alert: Tencent Sogou Input Method (Windows) is facing active 1-click RCE (CVE-2026-51990). Threat group UNC3569 is exploiting it via spear-phishing with malicious sgbiz:// links to deploy the GrayRabbit backdoor. Here’s the - detection, & mitigation 👇 2: The Attack Chain How it works: 1️⃣ Argument Injection: The sgbiz URI scheme (biz_helper.exe) fails to sanitize the param input. 2️⃣ Open Navigation: It forces the internal browser to load external attacker sites. 3️⃣ Outdated Engine: It spins up an un-sandboxed legacy Chromium v80 engine—no SOP, full system execution on a single click. 3: How to Identify & IoCs 🔍 Hunting & IoCs: • Look for suspicious child processes spawned by biz_helper.exe or SogouInput.exe (e.g., cmd.exe, powershell.exe, rundll32). • Monitor network logs & chat clients for inbound sgbiz:// URI calls. • Check for unsigned DLL drops or suspicious binaries in %LocalAppData%\SogouInput\. 4: Mitigation Steps 🛡️ Immediate Fixes: • Patch Sogou IME across endpoints immediately to the latest vendor build. • Registry workaround: Unregister the URI scheme under HKCR\sgbiz to kill the 1-click vector while awaiting rollout. • Block outbound C2 connections to known UNC3569 staging infrastructure at the perimeter. 5: YARA & Wrap-up Hunting rule logic: rule Exploit_Sogou_CVE_2026_51990 { strings: $URI = "sgbiz://" ascii nocase $param = "param=" ascii nocase $helper = "biz_helper.exe" ascii wide nocase condition: 2 of them } Stay vigilant & hunt early. @reach2ratan #CyberSecurity #InfoSec #ZeroDay #ThreatIntel #IncidentResponse #CVE202651990
Post summary
The post reports active in-the-wild exploitation of a zero-day 1-click RCE in Tencent Sogou Input Method by UNC3569, and provides IoCs, detection, and immediate patch/workaround guidance.
