GRAYRABBIT Backdoor via UNC3569 Exploitation of Sogou Input Method (CVE-2026-51990)

UNC3569, a China-nexus hacker-for-hire group that Google Threat Intelligence has tracked since 2021 against government, education, technology, and finance targets concentrated in East and Southeast Asia, is exploiting CVE-2026-51990, a one-click remote code execution flaw in Tencent's Sogou Input Method for Windows, to deploy the GRAYRABBIT backdoor. The attacker's objective is a durable, low-noise foothold: GRAYRABBIT provides a remote command shell, bidirectional file transfer, and on-demand module loading over a channel built to look unremarkable, raw TCP on port 443, RC4-scrambled instead of TLS.

The chain starts with a single click on a crafted sgbiz: link. Windows hands that link to biz_helper.exe, which does not validate the command-line arguments the link supplies and passes them straight to SGMyInput.exe. That process opens its skin-marketplace interface in an embedded, custom Chromium 80 build from March 2020 with the sandbox and same-origin policy disabled in code. The attacker-controlled page then exploits CVE-2021-38003, a V8 JSON.stringify type-confusion bug, for arbitrary code execution inside that unsandboxed browser process. Shellcode then downloads a legitimate 7z.exe, a trojanized loader DLL, and an encrypted payload from staging infrastructure, and DLL side-loading executes the encrypted blob, which decodes to GRAYRABBIT only if a process-count anti-sandbox check passes.

Tencent patched the reported chain in Sogou Input Method 16.3.0.3498 (released 2026-04-21) by restricting biz_helper.exe to HTTPS URLs on an allowlist of Sogou/Tencent hostnames. Gen Digital's own research states plainly that the obsolete, sandboxless Chromium 80 engine itself was not fixed, so any host running Sogou Input Method remains a standing risk to a future n-day in that same embedded browser.

The single highest-value defensive angle is behavioral rather than signature-based: the legitimate 7z.exe binary that side-loads the trojanized loader has no legitimate reason to make outbound network connections or spawn cmd.exe, and both behaviors are cheap, high-fidelity, and durable against C2 infrastructure rotation.

Defender priority: hunt and, once baselined, block on 7z.exe outbound network egress and 7z.exe-spawned cmd.exe first, these two behavioral signals catch GRAYRABBIT regardless of C2 domain or IP rotation. Patch Sogou Input Method to 16.3.0.3498 or later fleet-wide, and treat the product as a persistent residual risk afterward since its embedded browser sandbox remains disabled post-patch.

Tier	Source	Key Finding	Carry Forward
1 - Primary / Originating	Gen Digital / Gen Threat Labs (2026-09-10)	Full three-stage exploit chain, all three atomic hashes, the DLL naming lineage across download/PE-internal/on-disk names, the process-count anti-sandbox gate, RC4 C2 framing and command set, and the disclosure timeline	Yes
2 - Corroborating	The Hacker News (2026-09-11)	Actor attribution (UNC3569, tracked by Google Threat Intelligence since 2021), IOC corroboration, patch details	Yes
2 - Corroborating	GBHackers (2026-09-14)	Independent corroboration of the exploit chain and IOCs, plus detection recommendations for the sgbiz: pattern	Yes
2 - Corroborating	BleepingComputer	Malware capability summary and remediation timeline corroboration	Yes
N/A - attempted, unusable	Virus Bulletin VB2024 conference paper on UNC3569 / GRAYRABBIT history	PDF did not extract as readable text with available tooling	No - not cited, not saved as a snapshot
N/A - attempted, unusable	NVD record for CVE-2026-51990	Page did not return indexed CVE content at fetch time	No - not cited, not saved as a snapshot

Web Hunter Notes

No fetched source attempted to direct any action, claim prior authorization, or instruct a change to this pipeline's process. All four cited sources are treated strictly as data. The two unusable fetches above were not disqualified for any injection or trust concern, they simply returned content this pipeline's tooling could not extract, so nothing from them was cited or shipped.

DLL naming reconciliation

The seed intel flagged a naming discrepancy for hash 29c7ee41d0cc9e07d981e451df56d0c3d37c41ac4ec10c7b516cc033ee397a63. Gen Digital's primary research resolves this cleanly rather than leaving a real contradiction: the downloader shellcode fetches this file from the staging server as 7zp.dll, whose PE internal name is boy.dll, and then renames it to 7z.dll on disk in C:\Users\Public\Documents\ immediately before 7z.exe side-loads it. The Hacker News and GBHackers both describe only the final on-disk state and call it 7z.dll. All three names, 7zp.dll (download name), boy.dll (PE internal name), and 7z.dll (on-disk side-load name), refer to the same file at three points in its lifecycle and are recorded here together for hunt and EDR-query purposes.

Hunt hypotheses

1. H1 (high confidence): Sogou's SGMyInput.exe or biz_helper.exe is launched with a -url= command-line argument, evidence of sgbiz: protocol-handler abuse driving the embedded browser to an attacker-controlled page.
2. H2 (high confidence): The legitimate 7z.exe binary is executed from C:\Users\Public\Documents\ referencing the payload archive naming pattern used by the downloader shellcode.
3. H3 (high confidence): One of the three published GRAYRABBIT-chain hashes appears anywhere in process or file-write telemetry.
4. H4 (high confidence): 7z.exe makes an outbound network connection, a behavior the legitimate command-line 7-Zip tool never exhibits, strongly indicating the process has been hijacked by the reflectively-loaded GRAYRABBIT payload.
5. H5 (high confidence): cmd.exe is spawned as a child of 7z.exe, matching GRAYRABBIT's interactive reverse-shell command (command ID 1).
6. H6 (high confidence): A host resolves or connects to the published GRAYRABBIT C2 domain or staging IP.
7. H7 (medium confidence): A new PE or DLL is written to C:\Users\Public\Documents\, a broader staging-behavior signal with a higher benign base rate than H1-H6.

Attack chain

Step	Telemetry	Hunt Angle
1. Victim clicks a crafted sgbiz: link	Browser history / mail-gateway URL logs (not Falcon-visible)	Native audit-log hunt only (Section 7)
2. Windows hands the link to biz_helper.exe, which passes unvalidated args to SGMyInput.exe -page=skincenter -url=<attacker URL>	ProcessRollup2 / SyntheticProcessRollup2	Q1
3. Embedded Chromium 80 webview (sandbox and same-origin policy disabled) navigates to the attacker page and runs a CVE-2021-38003 V8 exploit for code execution	No direct Falcon field for in-process V8 exploitation, gap	Coverage gap, see Section 15
4. Downloader shellcode fetches 7z.exe, 7zp.dll (boy.dll), and p from the staging IP to C:\Users\Public\Documents\	PeFileWritten / NewExecutableWritten, NetworkConnectIP4 / DnsRequest	Q7, Q8
5. Shellcode renames 7zp.dll to 7z.dll and runs 7z.exe a p.7z p, triggering DLL side-load	ProcessRollup2 / SyntheticProcessRollup2	Q2
6. Loader gates decryption on a process-count check (>=50 processes = real host)	No Falcon field for in-process API-call counting, gap	Coverage gap, see Section 15
7. GRAYRABBIT (core.dll) is reflectively loaded and connects to C2 over RC4-scrambled raw TCP/443	NetworkConnectIP4, DnsRequest, and the hash match itself	Q3, Q4, Q6
8. Operator issues commands: reverse shell, file transfer, plugin load, sysinfo beacon	ProcessRollup2 (child cmd.exe), NetworkConnectIP4	Q5, Q4
9. Loader self-deletes via an NTFS alternate-data-stream rename-then-delete trick	Sensor-version-dependent file-deletion telemetry, gap	Native hunt only, see Section 7

Type	Value	Confidence	Action	Context	Expiry
sha256	29c7ee41d0cc9e07d981e451df56d0c3d37c41ac4ec10c7b516cc033ee397a63	high	detect	Trojanized DLL loader. Downloaded as 7zp.dll (PE internal name boy.dll), renamed to 7z.dll on disk for side-load by legitimate 7z.exe	2027-03-14
sha256	749160a2f20f82744026719cf72e483595c6aad718efa74d675a98662e02422e	high	detect	Encrypted GRAYRABBIT payload blob, on-disk filename p. Only decodes correctly on hosts with fewer than 50 running processes producing a zero anti-sandbox gate value	2027-03-14
sha256	d7a3c7eb94edc0e020f74c678743d71d61e944634aade4a67a96c3589e828b3a	high	detect	GRAYRABBIT backdoor, internal name core.dll, reflectively loaded in memory and never written to disk as a standalone PE post-decode	2027-03-14
domain	mail.uaiubifas.top	high	detect	GRAYRABBIT C2. Raw TCP port 443, RC4-encrypted 4096-byte frames, not TLS	2027-03-14
domain	noht1ng.top	high	detect	Exploit-hosting domain serving the CVE-2021-38003 V8 exploit page in the observed sgbiz: link	2027-03-14
ipv4	8.218.50.207	high	detect	Staging server (Alibaba Cloud, Hong Kong) hosting 7z.exe, 7zp.dll, and the encrypted payload p	2027-03-14
filename	p	low	pivot	Encrypted payload filename. Too generic (a single character) to ship as a standalone import indicator, converted to a behavioral pivot only, see Section 10	2026-10-14

Surface	Telemetry	Priority	Gap
Windows endpoints running Sogou Input Method < 16.3.0.3498	ProcessRollup2 / SyntheticProcessRollup2, PeFileWritten / NewExecutableWritten, NetworkConnectIP4 / DnsRequest	Critical	None, full Falcon sensor coverage available
Embedded Chromium 80 exploitation (CVE-2021-38003) in-process	No native Falcon field for in-process V8/JS heap corruption	High	GAP: only the downstream shellcode/download/side-load stages are observable, not the exploit itself
DLL side-load staging directory (C:\Users\Public\Documents\)	PeFileWritten, ProcessRollup2 parent/child	High	None
C2 channel (raw TCP 443, RC4)	NetworkConnectIP4, DnsRequest	Critical	Partial: RC4 payload content is opaque to Falcon network telemetry, detection relies on connection metadata and process identity, not payload parsing
NTFS alternate-data-stream self-deletion	Sensor-version-dependent file-deletion/rename telemetry	Medium	GAP: flag as a behavioral signal only, validate coverage in tenant
Anti-sandbox process-count gate (inside the loader)	No Falcon field exposes in-process API call counts (CreateToolhelp32Snapshot / Process32Next)	Medium	GAP: not directly hunted, see coverage map

Tactic	Technique	Technique Name	Observed Behavior
Initial Access	T1204.001	User Execution: Malicious Link	Victim clicks a crafted sgbiz: URI
Initial Access / Execution	T1203	Exploitation for Client Execution	CVE-2021-38003 V8 type-confusion exploited inside Sogou's embedded, sandboxless Chromium 80 webview
Execution	T1059.003	Windows Command Shell	GRAYRABBIT command 1 spawns an interactive cmd.exe reverse shell as a child of the hijacked host process
Persistence / Defense Evasion	T1574.002	Hijack Execution Flow: DLL Side-Loading	Legitimate 7z.exe side-loads the trojanized loader (downloaded as 7zp.dll, renamed 7z.dll)
Defense Evasion	T1497.001	Virtualization/Sandbox Evasion: System Checks	Process-count gate (<50 running processes) corrupts the XOR decryption key so the payload decodes to garbage in a sandbox
Defense Evasion	T1027	Obfuscated Files or Information	XOR-encrypted embedded PE, RC4-encrypted C2 traffic
Defense Evasion	T1620	Reflective Code Loading	GRAYRABBIT and its on-demand plugin modules are mapped and executed entirely in memory via PEB-walk import resolution, never written to disk as a standalone PE
Defense Evasion	T1070.004	Indicator Removal: File Deletion	Loader self-deletes via an NTFS alternate-data-stream rename-then-delete trick, no DeleteFileW call appears in logs
Command and Control	T1095	Non-Application Layer Protocol	Raw TCP on port 443, not TLS or any application-layer protocol
Command and Control	T1573.001	Encrypted Channel: Symmetric Cryptography	RC4 per-4096-byte-frame encryption with a static six-byte key
Command and Control	T1105	Ingress Tool Transfer	Downloader shellcode fetches 7z.exe / 7zp.dll / p from the staging IP; GRAYRABBIT loads further modules from C2 on demand
Discovery	T1082	System Information Discovery	Command 6 beacons IP address, hostname, username, and process name/PID to C2
Exfiltration	T1041	Exfiltration Over C2 Channel	FileMsg upload operation (command 9) moves local files out over the same RC4 channel

Non-CQL checks for environments without full Falcon coverage, or as a second telemetry source to corroborate Section 8 hits.

1. Registry: audit the sgbiz protocol handler

Confirm the handler still points at the legitimate, currently-installed Sogou binary and has not been tampered with:

Get-ItemProperty "Registry::HKEY_CLASSES_ROOT\sgbiz\shell\open\command"

2. Windows Security Event Log 4688 (process creation)

Where command-line auditing is enabled, match the same pattern as CQL Q1 for hosts without a Falcon sensor:

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688} |
  Where-Object { $_.Message -match '(SGMyInput|biz_helper)\.exe' -and $_.Message -match '-url=' }

3. Sysmon Event ID 1 (ProcessCreate) and Event ID 7 (ImageLoad)

Event ID 1 for the same -url= command-line pattern; Event ID 7 for 7z.exe loading a 7z.dll whose hash does not match the known-good 7-Zip release for the installed version.

4. Sysmon Event ID 3 (NetworkConnect)

Any outbound connection from 7z.exe, SGMyInput.exe, SGWebRender.exe, or biz_helper.exe is anomalous and mirrors CQL Q4.

5. Mail gateway / proxy log grep for the sgbiz scheme

The observed delivery URI, decoded, was sgbiz:sg_process?module=sgmyinput.exe&param=-page%3Dskincenter%20-url%3Dhttps%253A%252F%252Fnoht1ng.top%252Ffuckujjbangx.html. Search mail-gateway and web-proxy logs for the literal string sgbiz: in a URL or link-click event, independent of the destination domain, since the domain can rotate.

6. File-hash sweep of the staging directory

Hash every file in C:\Users\Public\Documents\ fleet-wide and compare against the three published SHA-256 hashes in Section 4, and separately flag any directory where a .dll was written after its paired legitimate .exe, the temporal signature of a side-load staging operation.

Candidate	Pattern	Exclusions	Deployment Path
Q4 - 7z.exe network egress	Parent/context process 7z.exe with any outbound NetworkConnectIP4 event	None identified; if a deployment tool bundles a network-aware 7-Zip variant, exclude that exact signed publisher/hash	Custom IOA, Detect for 2 weeks to confirm zero environment-specific FPs, then promote to Block
Q5 - cmd.exe child of 7z.exe	ParentBaseFileName=7z.exe, FileName=cmd.exe	None identified	Custom IOA, Block-eligible immediately given near-zero legitimate base rate
Q1 - Sogou -url= argument injection	FileName matches SGMyInput.exe/biz_helper.exe with -url= in CommandLine	None pre-patch; on patched hosts (16.3.0.3498+) the argument itself is validated internally, so this IOA still catches rejected attempts worth reviewing	Custom IOA, Detect fleet-wide during the patch rollout window, reassess after full patch coverage
Q2, Q3, Q6, Q7 - staging path / hash / C2 IOC hits	See CQL cards	N/A, IOC-based	IOC Management CSV (Section 10), Detect action; promote hashes to Prevent once confirmed against your own environment
Q8 - PE/DLL write to Public\Documents	TargetFileName under Public\Documents	See Q8 TUNING note	Investigate-only until an environment-specific baseline is established; not IOA-eligible in its current form

Gate	Requirement
Telemetry ready	Falcon sensor deployed with process, file-write, and network visibility on every Windows endpoint that has Sogou Input Method installed. Confirm with the Patch/ASR/Coverage Audit block in Section 10.
Benign baseline	Pull a 7-day benign baseline for Q4 (7z.exe network connections) and Q8 (Public\Documents PE writes) before enabling automated alerting on either; both are expected to be near-zero in a clean environment, any non-zero baseline needs investigation before the query goes live.
Positive tests	Validate Q1, Q2, Q3, Q5, Q6, and Q7 by replaying the published IOC values and command-line/parent-child patterns in a controlled lab process (never the live exploit chain, this pack is defensive-only). Confirm each query returns the synthetic hit.
Promotion path	Q4 and Q5 promote to Custom IOA (Detect for 2 weeks, then Block) after the baseline confirms zero legitimate hits. Q1, Q3, Q6, Q7 ship as IOC-based Detect entries now. Q2 and Q8 remain Investigate-only pending an environment-specific baseline.

TTP: GRAYRABBIT / UNC3569 via CVE-2026-51990 (Sogou Input Method one-click RCE)   MITRE Technique: T1203, T1204.001, T1574.002   Primary Mitigations: M1038, M1040, M1042, M1044, M1045, M1031, M1037, M1056

What to verify after deployment

• Run the Patch/ASR/Coverage Audit block (Section 10) against a sample of endpoints; expect Sogou version >= 16.3.0.3498 or the product absent entirely.
• Re-run Q4 and Q5 after the AppLocker/WDAC path restriction deploys; expect zero legitimate hits and the queries ready for Block promotion.

Playbook 1: Sogou Input Method Patch Verification & Removal Fallback

MITRE: T1203, T1204.001 → M1042   Estimated deploy time: 1-2 hours for the fleet-wide check, additional time per host for uninstall/update   Prerequisites: RMM or PowerShell-remoting access to target endpoints, local admin rights   Reboot required: No

Step 1 - Verify current Sogou Input Method version

What it does: Confirms which endpoints run a vulnerable pre-16.3.0.3498 build.
Why it works: You cannot patch or remove what you have not inventoried first.

Prerequisites: Read access to the uninstall registry hive. Reboot required: No.

Get-ItemProperty "HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*" |
  Where-Object { $_.DisplayName -match 'Sogou' } |
  Select-Object DisplayName, DisplayVersion, PSComputerName

Verify: Output shows DisplayVersion >= 16.3.0.3498, or no Sogou entry at all.

Rollback: none required, this step is read-only.

Step 2 - Force update, or uninstall if not business-approved

What it does: Brings the host to the patched version, or removes the exposure entirely.
Why it works: The patched biz_helper.exe validates -url against an HTTPS/allowlist check, closing the reported argument-injection path.

Prerequisites: Local admin rights, the vetted 16.3.0.3498+ MSI staged internally (or confirmation the product auto-updates). Reboot required: No.

# Uninstall path (use the product code returned by the Step 1 query)
$app = Get-CimInstance -ClassName Win32_Product | Where-Object { $_.Name -match 'Sogou' }
if ($app) { $app.Uninstall() }

Verify: Re-run the Step 1 query; expect no Sogou entry, or DisplayVersion >= 16.3.0.3498 if updated instead of removed.

Rollback: Reinstall Sogou Input Method 16.3.0.3498 or later from the vetted internal software repository if a business justification is confirmed after removal.

Playbook 2: Close the sgbiz Handler and the 7z.exe Side-Load Path

MITRE: T1204.001 → M1042; T1574.002 → M1038, M1044, M1045   Estimated deploy time: 2-4 hours to author and pilot the AppLocker rule, 1 day per pilot ring before fleet-wide Enforce   Prerequisites: Local admin rights, AppLocker or WDAC available (Windows 10/11 Enterprise or Education for full AppLocker feature set), a pilot ring of endpoints   Reboot required: No for the registry step; No for AppLocker policy application (policy refresh, not a reboot)

Step 1 - Audit the sgbiz protocol handler registration

What it does: Confirms the current handler target and captures it for rollback.
Why it works: You need the existing value backed up before removing it.

Prerequisites: Registry read access. Reboot required: No.

$backup = Get-ItemProperty "Registry::HKEY_CLASSES_ROOT\sgbiz\shell\open\command"
$backup | Export-Clixml -Path "C:\HardeningBackups\sgbiz-handler-backup.xml"
$backup

Verify: C:\HardeningBackups\sgbiz-handler-backup.xml exists and contains the original command value.

Rollback: none required, this step is read-only and only produces a backup file.

Step 2 - Remove the sgbiz protocol handler (hosts where Sogou is not required)

What it does: Deletes the sgbiz: URI registration so Windows can no longer route a crafted link to biz_helper.exe at all.
Why it works: Removing the handler closes the click-to-launch vector regardless of the Sogou binary's own patch level.

Prerequisites: Step 1 backup completed; confirm Sogou Input Method is not required on this host (see Playbook 1, Step 1). Reboot required: No.

Remove-Item -Path "Registry::HKEY_CLASSES_ROOT\sgbiz" -Recurse -Force

Verify:

Test-Path "Registry::HKEY_CLASSES_ROOT\sgbiz"
# Expect: False

Rollback:

Import-Clixml -Path "C:\HardeningBackups\sgbiz-handler-backup.xml" |
  ForEach-Object { New-Item -Path "Registry::HKEY_CLASSES_ROOT\sgbiz\shell\open\command" -Force |
    Set-ItemProperty -Name '(default)' -Value $_.'(default)' }
# Or simply reinstall Sogou Input Method, which re-registers the handler automatically.

Step 3 - AppLocker publisher/path rule restricting 7z.exe execution

What it does: Blocks 7z.exe from running anywhere outside its canonical install directory, closing the C:\Users\Public\Documents\ side-load staging path.
Why it works: The observed attack runs a downloaded copy of 7z.exe from a user-writable directory; a publisher+path rule stops that copy from executing even if it lands on disk.

Prerequisites: AppLocker service running, existing AppLocker policy baseline (do not deploy a first-ever AppLocker rule directly to Enforce). Reboot required: No, apply via gpupdate /force or policy refresh.

# Author in Audit mode first
New-AppLockerPolicy -RuleType Publisher -FileType Exe -User Everyone -Xml |
  Set-AppLockerPolicy -Merge

# Example rule condition (author via the AppLocker GPO editor for production use):
# Publisher: O=IGOR PAVLOV, path allowed: %PROGRAMFILES%\7-Zip\7z.exe
# Deny all other paths for a file named 7z.exe

Verify:

Get-AppLockerPolicy -Effective | Select-Object -ExpandProperty RuleCollections |
  Where-Object { $_.RuleCollectionType -eq 'Exe' }
# Confirm the 7z.exe path rule is present and, after the pilot period, set to Enforce

Rollback:

\# Remove the specific rule from the GPO-linked AppLocker policy via the AppLocker
\# policy editor, or set the Exe rule collection back to "Not configured" / Audit only.
Set-AppLockerPolicy -PolicyObject (New-Object -TypeName Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.AppLockerPolicy) -Merge

Compatibility note: Pilot on a small ring for at least a week before Enforce; confirm no internal tooling calls 7z.exe from a non-standard path (e.g., a portable/self-extracting deployment package) before fleet-wide rollout.

Step 4 - Falcon Custom IOA: block network egress from 7z.exe

What it does: Adds a behavioral prevention layer independent of the AppLocker path rule.
Why it works: Even if a trojanized 7z.exe evades the path restriction, GRAYRABBIT's C2 connection from that process is stopped at the network layer.

Not a script, Falcon Console UI:

1. Falcon Console → Endpoint security → Custom IOA rules → create a new rule matching ContextBaseFileName = 7z.exe with any NetworkConnectIP4 event.
2. Set action to Detect for the first 2 weeks (matches the Section 11 validation gate).
3. After a clean baseline, change the rule action to Block.

Prerequisites: Falcon Prevention policy applied to the target host group. Reboot required: No.

Verify: Falcon Console → Endpoint security → Activity → search for ContextBaseFileName:7z.exe over the last 24 hours after a controlled lab test connection.

Rollback: Disable or delete the Custom IOA rule from the Falcon Console.

---

Deploying via your RMM: the scripts above are raw PowerShell. To wrap them for fleet deployment (admin check, error handling, custom-field writeback for compliance tracking), hand them to your RMM deployment tooling and ask for a deployable package.

Phase	Actions	Owner	Evidence
Isolate	Network-isolate the affected host via Falcon RTR host containment to cut the C2 channel (mail.uaiubifas.top / 8.218.50.207) while preserving forensic state	IR / SOC on-call	Falcon containment timestamp and confirmation log
Isolate	Block the C2 domain, exploit-hosting domain, and staging IP at the perimeter firewall and DNS sinkhole	Network / Firewall team	Firewall rule-change ticket, DNS sinkhole log entry
Isolate	Capture volatile memory from the affected host before further action; GRAYRABBIT is reflectively loaded, so disk artifacts alone are insufficient for full recovery of the implant	DFIR	Memory capture file hash and chain-of-custody log
Eradicate	Terminate the compromised 7z.exe process and any child cmd.exe reverse shells identified via Q4/Q5	IR analyst	Falcon RTR process-kill audit log
Eradicate	Collect and hash the staging artifacts in C:\Users\Public\Documents\ (7z.exe, 7zp.dll/7z.dll, p, p.7z) before deletion, then remove them	IR analyst	Pre-deletion hash manifest, ticket noting file paths removed
Eradicate	Patch or remove Sogou Input Method on the affected host and any host sharing its deployment image or golden AMI (Playbook 1)	Endpoint engineering	Post-remediation version-check output
Eradicate	Rotate credentials active in any interactive session on the host while GRAYRABBIT's reverse shell (command 1) may have been running, given full command-execution capability was available to the operator	IAM / Identity team	Credential-rotation ticket, sign-in log showing forced re-authentication
Recover	Rebuild the affected endpoint from a known-clean, patched golden image rather than relying on in-place cleanup, given the reflective in-memory loading and NTFS ADS self-deletion techniques observed	Endpoint engineering	Re-image completion ticket
Recover	Re-enable network access only after confirming Q1-Q8 return clean and the patched Sogou version (or its removal) is verified	SOC	Clean hunt-query run exported to the ticket
Recover	Deploy the Immediate and Near-term hardening tiers fleet-wide, not just to the affected host, to prevent recurrence across the estate	Security engineering	Deployment completion report / RMM custom-field status
Recover	Run a retrospective on the initial-access vector (how the sgbiz: link reached the user) and update user-awareness training accordingly	SOC lead / Security awareness	Retrospective document, updated training module

Technique	Behavior	CQL	IOA	Coverage
T1204.001 / T1203	sgbiz: link click / -url= argument injection	Q1	Candidate (Detect)	Good
T1203 (in-browser)	CVE-2021-38003 V8 exploitation inside the embedded Chromium 80 webview	None	Not promoted	GAP - no Falcon field observes in-process V8/JS heap corruption; only downstream stages are visible
T1574.002	7zp.dll/boy.dll renamed to 7z.dll, side-loaded by 7z.exe	Q2, Q3	Candidate	Good
T1497.001	Process-count anti-sandbox gate inside the loader	None	Not promoted	GAP - occurs entirely in-process (CreateToolhelp32Snapshot/Process32Next); no Falcon field exposes this call count
T1059.003	cmd.exe reverse shell spawned by 7z.exe	Q5	Candidate (Block-eligible)	Good
T1095 / T1573.001	Raw TCP/443 RC4 C2 channel	Q4, Q6, Q7	Candidate (Q4 Block-eligible after baseline; Q6/Q7 IOC-based)	Good
T1620	Reflective in-memory loading of GRAYRABBIT and plugin modules	Q4 (behavioral proxy)	Not directly promoted	Partial - detected indirectly via the host process's anomalous behavior, not via a direct reflective-load telemetry field
T1070.004	NTFS alternate-data-stream self-deletion	None (native audit-log hunt only, Section 7)	Not promoted	GAP - sensor-version-dependent, validate coverage in tenant
T1082	System-info discovery beacon (command 6)	Covered indirectly via Q4	Not promoted	Partial - channel-level only, beacon content is opaque to Falcon
T1041	File exfiltration over the C2 channel (command 9)	Covered indirectly via Q4, Q6, Q7	Not promoted	Partial - channel-level only, RC4 payload content is opaque to Falcon network telemetry

All Section 11 validation gates apply before any candidate above is promoted from Detect to Block: telemetry coverage confirmed, a 7-day benign baseline pulled for Q4 and Q8, and a positive test fired against each query in a controlled lab process rather than the live exploit chain.

Tier	Source	Used For	Access Date
1 - Primary / Originating	Gen Digital / Gen Threat Labs - "Gray Rabbits and the Tale of a One-Click Backdoor"	Full exploit chain, all atomic IOCs, DLL naming lineage, anti-sandbox and C2 internals, disclosure timeline	2026-09-14
2 - Corroborating	The Hacker News - "China-Linked UNC3569 Exploited Sogou Input Method Flaw to Deploy GRAYRABBIT Backdoor"	Actor attribution, IOC corroboration, patch details	2026-09-14
2 - Corroborating	GBHackers - "China-Linked Hackers Exploit Sogou One-Click RCE to Deploy GRAYRABBIT Backdoor"	Exploit chain and IOC corroboration, detection recommendations	2026-09-14
2 - Corroborating	BleepingComputer - "Hackers exploit Tencent app flaw to deploy GrayRabbit malware"	Capability summary and remediation timeline corroboration	2026-09-14