The intrusion chain began with a crafted link and ultimately granted the attacker the same level of access as the logged-in user, meaning they could perform any action that user was permitted to carry out. The campaign resulted in the deployment of a backdoor identified as GRAYRABBIT.

Key points from the research:

• The targeted software is Sogou Input Method on Windows, one of the most commonly used Chinese input tools.
• Initial access was achieved through a crafted link.
• Post-exploitation access was limited only by the privileges of the compromised user account.
• The final payload observed was the GRAYRABBIT backdoor.
• The activity is attributed to UNC3569, a group linked to China.
• Tencent, which owns Sogou, was referenced in the report.

No specific CVE identifier was provided in the source material, so none is cited here. Organizations and users relying on Sogou Input Method should watch for vendor guidance and updates, and should treat unusual link-driven execution on Windows endpoints as a potential indicator of this activity.

Source: The Hacker News

Does your organization allow third-party input method software on Windows endpoints, and if so, how are you handling the risk?