🔴 Critical: Hackers exploit Tencent app flaw to deploy GrayRabbit malware
-
A China-aligned espionage group is actively exploiting a critical vulnerability in Tencent's Sogou Input Method for Windows to deliver a backdoor tracked as GrayRabbit. The flaw is being used as an initial access vector in targeted intrusions, with the goal of establishing persistence and enabling espionage activity on victim systems.
Key points:
- The vulnerability is tracked as CVE-2026-51990 and is rated critical.
- Affected software: Sogou Input Method for Windows, developed by Tencent.
- Payload deployed: the GrayRabbit backdoor.
- Attribution: a threat actor assessed to be aligned with Chinese state-sponsored espionage operations.
- Exploitation occurs through the vulnerable input method application, allowing the attacker to run code and drop the backdoor.
Mitigation and response guidance:
- Patch or update the Sogou Input Method to the latest version as soon as a fix is available.
- If the application is not required in your environment, consider removing or restricting it.
- Monitor endpoints for unusual child processes spawned by the input method software.
- Hunt for indicators of GrayRabbit persistence and command-and-control traffic.
- Apply network-level detections for known malicious infrastructure associated with this campaign.
Organizations relying on Sogou Input Method in Windows environments should treat this as a priority given the espionage motivation behind the exploitation.
Source: Unknown
Is Sogou Input Method present anywhere in your environment, and if so, how are you handling the risk?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login