Cyber Threat Brief — September 14 2026
⚠️ This report is AI-generated. Always validate findings.
1. Sogou One-Click → GRAYRABBIT — CVE-2026-51990
TL;DR: Gen Threat Labs (primary 2026-09-10; THN 2026-09-11; BC amplify 2026-09-13): PRC-nexus UNC3569 exploits CVE-2026-51990 in Tencent Sogou Input Method via crafted sgbiz: URI → unvalidated -url into sandboxless Chromium 80 → CVE-2021-38003 → 7-Zip DLL sideload → GRAYRABBIT C2. Patch ≥16.3.0.3498 (Apr 21 auto-update); CEF still insecure post-fix.
What’s New:
- BC 2026-09-13 + X amplify 2026-09-14 elevate Gen’s ITW chain; first brief lead
- Entry:
sgbiz:sg_process?module=sgmyinput.exe¶m=-page=skincenter -url=<attacker>→biz_helper.exe→SGMyInput.exe→SGWebRender.exe(CEF 80,no_sandbox=1,disable-web-security) - Observed lure:
https://noht1ng.top/fuckujjbangx.html(CVE-2021-38003 JS) → staging8.218.50.207drops7z.exe+ trojanized7z.dll+ encryptedpintoC:\Users\Public\Documents\ - C2:
mail.uaiubifas.top:443raw TCP (not TLS), RC4 keym5b1u3, 4096-byte frames; implant exportCoreClientInstall/ modulecore.dll - Fix only in
biz_helper.exe(HTTPS + allowlistsogou.com/qq.com/woa.com/sogou); inventory lingering installs; hunt IOCs even if patched (loader self-deletes via ADS)
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| Sogou Input Method < 16.3.0.3498 (CVE-2026-51990) | Vulnerable IME | T1190 / T1204.001 | Intune/SCCM software inventory / HKLM\SOFTWARE\Tencent\Sogou* | Inventory + force update to ≥16.3.0.3498; remove unmanaged installs on non-CN fleets if unused |
Process Image ends with \biz_helper.exe with CommandLine containing sgbiz: and skincenter / -url= | Exploit launch | T1204.001 / T1059 | Sysmon 1 / EDR | Alert; isolate host; reconstruct full sgbiz: URI from cmdline |
ParentImage ends with \SGMyInput.exe or \SGWebRender.exe spawning network/child write under C:\Users\Public\Documents\ | Exploit browser stage | T1189 / T1105 | Sysmon 1+11 / EDR | Alert; dump browser child cmdline for -url= attacker host |
Files C:\Users\Public\Documents\7z.exe, C:\Users\Public\Documents\7z.dll, C:\Users\Public\Documents\p (or p.7z) | Staging / sideload | T1574.001 / T1105 | Sysmon 11 / FIM | Quarantine; hash vs Gen SHA256 below; alert 7z.exe CREATE_NO_WINDOW archive cmdline for p |
SHA256 29c7ee41d0cc9e07d981e451df56d0c3d37c41ac4ec10c7b516cc033ee397a63 (7z.dll / boy.dll), 749160a2f20f82744026719cf72e483595c6aad718efa74d675a98662e02422e (p), d7a3c7eb94edc0e020f74c678743d71d61e944634aade4a67a96c3589e828b3a (GRAYRABBIT core.dll) | Malware hashes | T1105 / T1620 | EDR hash / VT / MDE | Block + historical presence hunt; note loader may ADS-self-delete |
Domains noht1ng.top, mail.uaiubifas.top; IP 8.218.50.207 | Exploit + C2 / staging | T1071.001 / T1105 | DNS / proxy / firewall | Block + hunt resolves/connects; alert port 443 to mail.uaiubifas.top without TLS ClientHello (raw TCP RC4) |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | Partial — verified logic — Windows Suspicious Process File Path (process_path IN *\users\public\*) catches C:\Users\Public\Documents\7z.exe | No ESCU for sgbiz: / biz_helper.exe / SGWebRender.exe / 7z.dll sideload / GRAYRABBIT C2; Anomalous usage of 7zip requires parent rundll32/dllhost — misses this chain; Windows Identify Protocol Handlers is lookup-gated — sgbiz: unlikely mapped |
| Elastic | Partial — verified logic — Process Execution from an Unusual Directory (Users\Public\*.exe; FP list includes Documents paths) | No mapped rule for CVE-2026-51990 / sgbiz: / 7z.dll ImageLoad / RC4-on-443 C2 |
| Sigma | None — verified search for CVE-2026-51990 / GRAYRABBIT / sgbiz | Potential 7za.DLL Sideloading matches 7za.dll only — wrong DLL name vs observed 7z.dll |
Hunt hint: (1) Inventory Sogou < 16.3.0.3498. (2) Sysmon 1: biz_helper.exe/SGMyInput.exe with skincenter+-url=. (3) File create / ImageLoad of C:\Users\Public\Documents\7z.dll beside 7z.exe. (4) DNS/proxy: noht1ng.top / mail.uaiubifas.top / 8.218.50.207. (5) Non-TLS TCP/443 to C2. On hit: isolate, hash-hunt three SHA256s, revoke sessions, remove Sogou or patch, rebuild if implant confirmed.
Sources: Gen Threat Labs, The Hacker News, BleepingComputer, GitHub PoC tracker
Status Updates
- CVE-2026-85706 (GitLab): CISA KEV due TODAY 2026-09-14 — BC amplify confirms ITW; patch self-managed to 19.1.8 / 19.2.6 / 19.3.2; hunt
POST /api/v4/projects/*/repository/commits/withfile.path. Sep 12 · BC Sep 14 - CVE-2026-84869 (ScreenConnect): KEV due TODAY — clients ≥26.6.5; remove TransferFiles until done; SecurityWeek notes worm-like VBScript propagation via rogue clients. Sep 12
- PaperCut CVE-2026-81578/82078: KEV due TODAY — continue AI-swarm hunts (
45.142.193.132,pc-*.hiv,Administrator17). Sep 11 - MikroTrick CVE-2026-67277 / CVE-2026-86060: KEV due was 2026-09-13 — confirm RouterOS 7.24.2 / 7.23.4 / 6.49.21; hunt
ops/ssh:-2@. Sep 6 · Sep 13 staging - Check Point CVE-2026-85102/85103: Dutch NCSC still imminent — LivePatch Take 24 / Jumbo R81.20 Take 166 / R82 Take 126 / R82.10 Take 44. Sep 11
- CVE-2026-42016/42018 (JFrog): KEV due 2026-09-25 — continue
POST /access/api/v1/aws/token/+token:anonymoushunts. Sep 12 - Chrome CVE-2026-85046 (due Sep 18) / Windows CVE-2026-81963+85880 (due Sep 22) / Chrome CVE-2026-87491 (due Sep 23): keep BlueMoon browser→curl→
%TEMP%\msgbox.exehunts. Sep 11 · Sep 9 - Storm-3121/3032 Passkey + SGLang CVE-2026-86793: No material change — keep prior hunts (
python-httpx,NO_DEVICEMFA;/update_weights_from_tensor). Sep 13 staging