Key points:

• The vulnerability is tracked as CVE-2026-51990 and is rated critical.
• Affected software: Sogou Input Method for Windows, developed by Tencent.
• Payload deployed: the GrayRabbit backdoor.
• Attribution: a threat actor assessed to be aligned with Chinese state-sponsored espionage operations.
• Exploitation occurs through the vulnerable input method application, allowing the attacker to run code and drop the backdoor.

Mitigation and response guidance:

• Patch or update the Sogou Input Method to the latest version as soon as a fix is available.
• If the application is not required in your environment, consider removing or restricting it.
• Monitor endpoints for unusual child processes spawned by the input method software.
• Hunt for indicators of GrayRabbit persistence and command-and-control traffic.
• Apply network-level detections for known malicious infrastructure associated with this campaign.

Organizations relying on Sogou Input Method in Windows environments should treat this as a priority given the espionage motivation behind the exploitation.

Source: Unknown
Is Sogou Input Method present anywhere in your environment, and if so, how are you handling the risk?