A critical vulnerability, CVE-2026-51990, in Tencent's Sogou Input Method for Windows is being actively exploited by a China-aligned espionage group to deploy the GrayRabbit backdoor malware.

{
  "signal_id": "94a7ef78-7a19-5183-af86-b81f39627892",
  "signal_type": "reddit-company",
  "signal_subtype": "cybersecurityIncident",
  "detected_at": "2026-09-13T15:03:30+00:00",
  "company": {
    "name": "Tencent",
    "domain": "tencent.com"
  },
  "data": {
    "nsfw": false,
    "stage": "confirmed",
    "awards": 0,
    "timing": "in_progress",
    "topics": [
      "cybersecurity",
      "vulnerability",
      "active exploitation",
      "malware",
      "espionage"
    ],
    "post_id": "1wfa39o",
    "summary": "A critical vulnerability, CVE-2026-51990, in Tencent's Sogou Input Method for Windows is being actively exploited by a China-aligned espionage group to deploy the GrayRabbit backdoor malware.",
    "category": "active_exploitation",
    "evidence": [
      "[post] Threat actors linked to a China-aligned espionage group are actively exploiting CVE-2026-51990, a critical vulnerability in Tencent’s Sogou Input Method for Windows, to deploy the GrayRabbit backdoor.",
      "[post] The vulnerability allows for privilege escalation or code execution within the input method’s context.",
      "[post] Affected Versions: All versions of Sogou Input Method for Windows prior to the latest patch released on 2026-03-10."
    ],
    "virality": "very_low",
    "post_date": "2026-09-13T15:03:30.000Z",
    "post_kind": "multi_media",
    "post_text": "Threat actors linked to a China-aligned espionage group are actively exploiting CVE-2026-51990, a critical vulnerability in Tencent’s Sogou Input Method for Windows, to deploy the GrayRabbit backdoor. This is a targeted campaign, not a broad spray-and-pray operation.\n\nTTPs (MITRE): Initial access via exploitation of a public-facing application (T1190). The vulnerability allows for privilege escalation or code execution within the input method’s context. Persistence is achieved via the GrayRabbit backdoor, which likely establishes C2 communications.\n\nIOCs: No specific hashes or IPs have been published at this time. The primary indicator is the presence of the Sogou Input Method (a common application in Chinese-speaking environments) and subsequent anomalous network traffic from the host.\n\nAffected Versions: All versions of Sogou Input Method for Windows prior to the latest patch released on 2026-03-10.\n\nDefense: Immediately update Sogou Input Method to the latest patched version. Monitor for unusual outbound connections from hosts running this software, particularly to non-standard ports or known adversary infrastructure. EDR rules should flag any process spawning from the input method’s executable (SogouTSF.exe or similar) that attempts to execute cmd.exe, powershell.exe, or write to %APPDATA% or %TEMP%.\n\nSource...",
    "sentiment": "negative",
    "subreddit": "SecOpsDaily",
    "event_date": "2026-09",
    "post_flair": [
      "NEWS"
    ],
    "post_title": "Hackers exploit Tencent app flaw to deploy GrayRabbit malware",
    "prominence": "core",
    "source_url": "https://www.reddit.com/r/SecOpsDaily/comments/1wfa39o/hackers_exploit_tencent_app_flaw_to_deploy/",
    "entity_role": "subject",
    "post_author": "falconupkid",
    "upvote_ratio": 1,
    "mention_count": 2,
    "mention_surge": false,
    "subreddit_url": "https://www.reddit.com/r/SecOpsDaily/",
    "total_upvotes": 3,
    "comments_total": 0,
    "total_comments": 0,
    "event_date_text": "actively",
    "post_author_url": "https://www.reddit.com/user/falconupkid/",
    "signal_category": "event",
    "comments_included": 0,
    "products_mentioned": [
      "Sogou Input Method for Windows"
    ]
  }
}

curl https://signals.autobound.ai/v1/signals/94a7ef78-7a19-5183-af86-b81f39627892 \
  -H "X-API-KEY: $AUTOBOUND_API_KEY"

curl -X POST https://signals.autobound.ai/v1/companies/enrich \
  -H "X-API-KEY: $AUTOBOUND_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"domain":"tencent.com","limit":20}'