Sogou CVE-2026-51990: How to Hunt for GRAYRABBIT
ACTION BRIEF • WINDOWS ENDPOINTS
If your organization uses Sogou Input Method for Windows, verify its version and investigate suspicious activity from before it was patched. A malicious link can exploit a vulnerable installation to deliver GRAYRABBIT, a backdoor that gives an attacker access in the signed-in user’s context.
Your first three actions: identify affected devices, update the software, and check whether attackers used it before the update. Patching closes the reported entry path; it does not establish that a previously compromised endpoint is clean.
Who needs to act?
IT teams: inventory Sogou Input Method on Windows endpoints, including devices outside your standard image. Record the installed version and update history.
Security teams: review unusual Sogou command lines, suspicious files in Public Documents, and related network activity.
Business leaders: ask whether affected devices were checked for prior compromise and what evidence supports the result.
Prioritize actual software inventory over assumptions about a user’s location or language. An installed copy establishes exposure; it does not, by itself, establish compromise.
What Sogou CVE-2026-51990 changes for defenders
Gen Threat Labs’ original research describes UNC3569 exploiting Sogou Input Method to deliver GRAYRABBIT. Three weaknesses connect a custom Windows protocol handler to an outdated, unsandboxed embedded browser.
Gen describes the attack as “one-click.” Tencent’s response adds that the user must authorize a browser pop-up prompt. Keep that interaction requirement in mind when explaining the risk: this is a malicious-link attack against vulnerable installations.
A trusted launcher accepts untrusted arguments. Windows routes an sgbiz: link to biz_helper.exe. The vulnerable handler checks which Sogou executable is requested, but passes the supplied arguments to it without equivalent validation.
The skin center opens an attacker-controlled destination. SGMyInput.exe uses the -page=skincenter and -url= arguments to open a page inside a Chromium Embedded Framework (CEF) webview.
The embedded browser allows the compromise to reach the endpoint. Gen identifies Chromium 80 without a sandbox. In the observed attack, the exploit page abused CVE-2021-38003, leading to code execution with the current user’s privileges.
The distinction matters: a legitimate, signed application can participate in malicious activity. Review its arguments, child processes, file activity, and network connections together.
Patch the entry point—and investigate earlier access
Gen reports that Tencent deployed the fix in version 16.3.0.3498 on April 21, 2026. Update to the latest supported release and verify deployment. The initial fix restricts URL-bearing arguments at the protocol handler. Gen also reports that the embedded browser remains outdated and unsandboxed in the builds it examined.
Do not start the investigation at the September publication date. The vulnerability was reported to Tencent on April 9, 2026. Choose the hunt window from the device’s installation and patch history, suspected activity, and available retention. A 30-day search is a convenient starting point when that is all the telemetry available; it is not a complete exposure window.
Preserve full command lines, process lineage, file events, DNS and network records, and available hashes. If malicious execution is confirmed, isolate the endpoint under your incident response process, investigate the affected account and follow-on activity, and decide whether recovery requires a rebuild from a trusted baseline.
Evidence to look for
Stage and artifact | Investigation focus |
Launch biz_helper.exe; SGMyInput.exe; SGWebRender.exe | Unexpected skincenter or -url= arguments and external destinations. |
Staging 8.218.50[.]207 | Downloads near the suspicious process tree. |
Files Public Documents | 7z.exe, malicious 7z.dll, and p. The command references p.7z; do not require that archive to exist. |
Execution 7-Zip DLL sideload | 7z.exe loading the adjacent 7z.dll; follow-on execution and memory evidence. |
Command and control mail.uaiubifas[.]top | Raw TCP on port 443 with RC4 encryption, not HTTPS. |
The reported staging directory is C:\Users\Public\Documents\.
The download name 7zp.dll and internal name boy.dll refer to the loader saved as 7z.dll. GRAYRABBIT’s internal module name is core.dll. Internal names are not reliable on-disk filenames: the payload is reflectively loaded, and the loader can delete itself. Missing files or ordinary module-load events do not rule out execution.
Hunting queries: start broad, then correlate
These queries are investigation starting points, not standalone compromise verdicts. They have been reviewed for logic but have not been executed against a live tenant. Validate syntax and field mappings in your platform, use a known event to check collection, and set the time range before running them.
Run process, file, and network searches separately, then correlate by device, account, and time. Requiring all stages in one event can hide the activity you need to find.
Microsoft Defender / Sentinel: process activity
These examples use Microsoft Defender for Endpoint tables. Sentinel needs those tables ingested into the workspace. Substring comparisons preserve punctuation in command-line switches.
// Example window only: adjust to exposure and available retention.
let StartTime = ago(30d);
DeviceProcessEvents
| where Timestamp >= StartTime
| where FileName in~ ("biz_helper.exe", "SGMyInput.exe", "SGWebRender.exe")
or InitiatingProcessFileName =~ "biz_helper.exe"
| where ProcessCommandLine contains "skincenter"
or ProcessCommandLine contains "-url="
or ProcessCommandLine contains "-page="
or InitiatingProcessCommandLine contains "skincenter"
or InitiatingProcessCommandLine contains "-url="
| project Timestamp, DeviceId, DeviceName, AccountName,
FileName, ProcessCommandLine, InitiatingProcessFileName,
InitiatingProcessCommandLine
| order by Timestamp ascMicrosoft Defender / Sentinel: files and hashes
The path-and-name branch finds reported staging artifacts. The independent hash branch checks all paths and uses case-insensitive matching.
let StartTime = ago(30d);
DeviceFileEvents
| where Timestamp >= StartTime
| where (
FolderPath startswith @"C:\Users\Public\Documents\"
and FileName in~ ("7z.exe", "7z.dll", "7zp.dll", "p", "p.7z")
)
or SHA256 in~ (
"29c7ee41d0cc9e07d981e451df56d0c3d37c41ac4ec10c7b516cc033ee397a63",
"749160a2f20f82744026719cf72e483595c6aad718efa74d675a98662e02422e",
"d7a3c7eb94edc0e020f74c678743d71d61e944634aade4a67a96c3589e828b3a"
)
| project Timestamp, DeviceId, DeviceName, ActionType,
FileName, FolderPath, SHA1, SHA256,
InitiatingProcessFileName, InitiatingProcessCommandLine
| order by Timestamp ascMicrosoft notes that SHA256 is usually unpopulated in DeviceFileEvents. Keep the behavioral branch, retain SHA1 when present, and use a verified hash source or collected sample for additional comparison. A missing hash is a visibility limitation.
Microsoft Defender / Sentinel: network activity
let StartTime = ago(30d);
DeviceNetworkEvents
| where Timestamp >= StartTime
| where RemoteIP == "8.218.50.207"
or RemoteUrl in~ ("noht1ng.top", "mail.uaiubifas.top")
| project Timestamp, DeviceId, DeviceName, ActionType,
RemoteUrl, RemoteIP, RemotePort,
InitiatingProcessFileName, InitiatingProcessCommandLine
| order by Timestamp ascThis example matches exact hostnames and the reported staging IP. If your URL field includes full URLs, normalize the hostname or adapt the comparison. Review DNS separately when available; a DNS lookup alone does not establish a successful connection.
CrowdStrike Falcon: process activity
Use a Falcon endpoint-event repository with the fields below and select the exposure window in the time picker. This hunt filters the current process’s command line; inspect the process tree for parent arguments.
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| (FileName=/^(biz_helper|SGMyInput|SGWebRender)\.exe$/i
OR ParentBaseFileName=/^biz_helper\.exe$/i)
| CommandLine=/skincenter|-url=|-page=/i
| table([@timestamp, aid, ComputerName, UserName,
FileName, CommandLine, ParentBaseFileName], limit=1000)Pivot from the device identifier and timestamp into Public Documents file activity, DLL loads, DNS, and network events. Confirm the appropriate event types in your repository. The table is capped at 1,000 rows; narrow the interval or export the relevant events if results reach that limit.
Splunk: process activity
Replace YOUR_ENDPOINT_INDEX and select the time window. The field aliases below are examples; map them to your actual endpoint source.
index=YOUR_ENDPOINT_INDEX
| eval proc=lower(coalesce(process_name, Image, file_name, process, ""))
| eval parent=lower(coalesce(parent_process_name, ParentImage, parent_process, ""))
| eval cmdline=coalesce(process_command_line, CommandLine, command_line, "")
| where (
like(proc, "%biz_helper.exe")
OR like(proc, "%sgmyinput.exe")
OR like(proc, "%sgwebrender.exe")
OR like(parent, "%biz_helper.exe")
)
AND (
like(lower(cmdline), "%skincenter%")
OR like(lower(cmdline), "%-url=%")
OR like(lower(cmdline), "%-page=%")
)
| table _time host user proc parent cmdline
| sort 0 _timeSplunk: file activity and hashes
Run this independently of the process search so file events created by 7-Zip are not excluded by an earlier Sogou process filter. The artifact field must contain the full file path, including the filename.
index=YOUR_ENDPOINT_INDEX
| eval artifact=lower(coalesce(TargetFilename, file_path, path, ""))
| eval hash256=lower(coalesce(SHA256, sha256, file_hash_sha256, ""))
| where (
like(artifact, "c:\\users\\public\\documents\\%")
AND (
like(artifact, "%\\7z.exe")
OR like(artifact, "%\\7z.dll")
OR like(artifact, "%\\7zp.dll")
OR like(artifact, "%\\p")
OR like(artifact, "%\\p.7z")
)
)
OR in(hash256,
"29c7ee41d0cc9e07d981e451df56d0c3d37c41ac4ec10c7b516cc033ee397a63",
"749160a2f20f82744026719cf72e483595c6aad718efa74d675a98662e02422e",
"d7a3c7eb94edc0e020f74c678743d71d61e944634aade4a67a96c3589e828b3a"
)
| table _time host user artifact hash256 Image process_name
| sort 0 _timeIf hashes arrive inside a combined Hashes field, extract SHA256 first. Add separate DNS and network searches for the indicators below.
Elastic / Kibana: process activity
These filters use Kibana Query Language and ECS fields. Check the actual spelling and case in your data. The process filter uses leading wildcards, which require the query:allowLeadingWildcards setting; they can be expensive, so narrow the dataset and time range.
(
process.name: ("biz_helper.exe" or "SGMyInput.exe" or "SGWebRender.exe")
or process.parent.name: "biz_helper.exe"
)
and process.command_line: (*skincenter* or *-url=* or *-page=*)Elastic / Kibana: file activity
file.directory: "C:\\Users\\Public\\Documents"
and file.name: ("7z.exe" or "7z.dll" or "7zp.dll" or "p" or "p.7z")This exact-directory filter avoids leading wildcards. Confirm file.directory is populated, including its capitalization and trailing-slash convention. Search the published hashes independently in file.hash.sha256 so files elsewhere remain discoverable.
Elastic / Kibana: DNS and network activity
dns.question.name: ("noht1ng.top" or "mail.uaiubifas.top")
or destination.domain: ("noht1ng.top" or "mail.uaiubifas.top")
or destination.ip: "8.218.50.207"When a match deserves escalation
Finding | Assessment and next step |
Sogou installed or ordinary skin-center activity | Exposure or a low-confidence lead. Check the version, destination, and process activity. |
External -url= with suspicious staging | High priority. Preserve the process tree and adjacent file and network evidence. |
Reported malicious file hash | Malicious content is present in telemetry. Identify the component and verify whether it executed. |
Malicious execution correlated with C2 | Strong compromise evidence. Contain, scope follow-on activity, and establish recovery criteria. |
No matches | Check sensor coverage, fields, retention, and time range before closing. |
Benign skin-center use and legitimate 7-Zip activity are common enough to require context. Equally, patching, blocking a domain, or deleting one DLL does not establish that all attacker access has been removed.
Indicators for reference
Network indicators are defanged below. The queries above use searchable values.
noht1ng[.]top — exploit hosting
8.218.50[.]207 — staging server
mail.uaiubifas[.]top — command and control
SHA-256: loader downloaded as 7zp.dll; saved as 7z.dll
29c7ee41d0cc9e07d981e451df56d0c3d37c41ac4ec10c7b516cc033ee397a63SHA-256: encrypted payload blob p
749160a2f20f82744026719cf72e483595c6aad718efa74d675a98662e02422eSHA-256: GRAYRABBIT payload; internal name core.dll
d7a3c7eb94edc0e020f74c678743d71d61e944634aade4a67a96c3589e828b3aWhat a defensible closure looks like
Record which endpoints were exposed, when they were updated, which evidence was reviewed, what was found, and how confirmed compromise was addressed. State any logging gaps and the period you could actually assess. That gives your team a clear basis for returning an endpoint to service.
The broader lesson applies beyond Sogou: when a trusted helper launches with unexpected arguments, follow the activity into files, child processes, and network connections. The application’s reputation is only one part of the evidence.
Turn Microsoft security visibility into action
Inception Protection helps organizations investigate and respond using Microsoft Defender and Sentinel. If you want to understand your broader Microsoft 365 security posture, start with our free Inception Foresight M365 Assessment. It can highlight configuration gaps and inform next steps; determining whether an endpoint was compromised requires a separate investigation.
Sources and query references
Gen Threat Labs: Gray Rabbits and the Tale of a One-Click Backdoor — original research, published September 10, 2026; attack details, indicators, and disclosure timeline.
Microsoft: Kusto string operators and DeviceFileEvents schema.
