#ParsedReport #CompletenessMedium
10-09-2026

Gray Rabbits and the Tale of a One-Click Backdoor

https://www.gendigital.com/blog/insights/research/one-click-backdoor-sogou

Report completeness: Medium

Actors/Campaigns:
Unc3569

Threats:
Grayrabbit

Victims:
Government, Education, Technology, Finance

Industry:
Financial, Education, E-commerce, Government

Geo:
Asia, Hong kong, China, Chinese, Singapore

CVEs:
CVE-2026-51990 [Vulners]
CVSS V3.1: Unknown,
Vulners: Exploitation: Unknown

CVE-2021-38003 [Vulners]
CVSS V3.1: 8.8,
Vulners: Exploitation: True
Soft:
- google chrome (<95.0.4638.69)


ChatGPT TTPs:
do not use without manual check
T1016, T1027, T1027.013, T1033, T1036.005, T1057, T1082, T1095, T1105, T1140, have more...

IOCs:
File: 13
Domain: 2
IP: 1
Hash: 3

Soft:
Sogou, Chromium, Chrome, Alibaba Cloud

Algorithms:
sha256, rc4, xor

Functions:
GetBrowserManagerInstance, PopulateCefSettings, OnWebViewIsReady, makeMapOdd, CreateEncoder, CreateObject, GetHandlerProperty, GetModuleProp

Win API:
GetFileAttributesW, CreateProcessW, ShellExecuteW, WinMain, LoadLibraryExW, GetCommandLineW, LoadLibraryW, CreateProcessA, CreateToolhelp32Snapshot, Process32First, have more...

Languages:
javascript

Platforms:
x86, x64