China-linked hackers slipped a backdoor onto PCs through Sogou, a popular Chinese typing tool

Key points

• Gen Digital researchers published findings on Thursday tying the intrusion set to a China-nexus group tracked as UNC3569.
• The attackers abused a flaw in Sogou Input Method, a tool used to type Chinese characters on Windows.
• Victims only had to click a crafted link for a backdoor, dubbed GRAYRABBIT, to be installed.
• Once inside, the malware could do anything the logged-in user could do, from reading files to running commands.
• Sogou is owned by Tencent, one of China's largest technology companies.

A China-linked hacking crew used a weakness in one of the most common Chinese typing tools on Windows to plant a backdoor on victims' computers, according to research published Thursday by Gen Digital.

The tool is Sogou Input Method, software that turns keystrokes into Chinese characters on screen. It sits on a large share of Windows PCs across mainland China and the diaspora.

Gen Digital attributes the activity with medium confidence to a cluster it labels UNC3569. Other vendors haven't published overlapping names yet, so treat the attribution as single-source for now. Our 24 August report on Operation QUICSILVER found a similar pattern: a China-nexus crew pairing a novel backdoor with a low-friction delivery method against a narrow target set.

How did the attack work?

It started with a link. A victim clicked what looked like an ordinary URL, and the vulnerability in Sogou did the rest, quietly dropping a backdoor the researchers call GRAYRABBIT onto the machine.

A backdoor is a hidden channel into a system. Once GRAYRABBIT is running, the attacker can do whatever the person at the keyboard could do: open documents, copy files, or pivot deeper into a network. No noisy attachment, no obvious warning. A poisoned link and a trusted piece of software doing the heavy lifting.

Who is UNC3569?

UNC3569 is a tracking label, not a household name. The "UNC" prefix, used in Mandiant's naming convention, means "uncategorised": a cluster of activity that looks coherent but hasn't been merged into a named group like Mustang Panda.

Gen Digital places the cluster in the China-nexus space based on victimology and tooling. That's a statement about capability and likely sponsorship, not a courtroom-grade identification. Overlaps with better-known Chinese espionage crews may emerge as more telemetry comes in.

Should ordinary users be worried?

Users who don't run Sogou Input Method aren't in the crosshairs. Anyone who does should update as soon as Tencent pushes a fix and treat unexpected links with extra caution, even from familiar contacts.

Espionage operators like UNC3569 tend to hunt specific people: journalists, dissidents, executives at firms of interest to Beijing. Mass consumer harm is unlikely. Targeted harm to the right individual can be severe.

What we still do not know

Gen Digital hasn't published the exact CVE identifier for the Sogou flaw, and Tencent had issued no public advisory at the time of writing. The victim count is also unclear.

Expect other threat intelligence teams to weigh in over the coming days. The sensible read right now: capable actor, narrow tooling, targeted intent. What I'd watch is whether any other vendor surfaces overlapping infrastructure, because a second data point would push this well past single-source territory.