TENCENT FLAW EXPLOITED TO DEPLOY GRAYRABBIT MALWARE

The vulnerability, tracked as CVE-2026-51990, affects the widely-used Chinese input software. Attackers are leveraging the flaw to gain unauthorized system access and establish persistent backdoor access on compromised machines. GrayRabbit is a sophisticated backdoor associated with state-sponsored espionage operations. Once deployed, the malware enables attackers to execute arbitrary commands, exfiltrate data, and maintain long-term access to infected systems. Tencent has been notified of the vulnerability. Users of Sogou Input Method for Windows are advised to apply security updates immediately. Organizations in high-risk sectors should prioritize patching systems running the affected software. The exploitation underscores the ongoing threat from nation-state actors targeting commercial software supply chains. Security researchers recommend monitoring systems for indicators of compromise and implementing network segmentation to limit potential lateral movement.