kyber.today

daily cyber × ai intelligence

← threat actors

threat actor · CN

UNC3569

1 story · 1 in the wild · September 12, 2026 – September 12, 2026

evidence: 1 observed

geography

  • china 1 · Sep 12

malware and tools

  • grayrabbit 1 · Sep 12

techniques

  • argument injection 1 · Sep 12
  • code execution 1 · Sep 12
  • sandbox escape 1 · Sep 12

attack phases seen

  • Execution 1 · Sep 12
  • Initial access 1 · Sep 12
  • Persistence 1 · Sep 12

what we reported, newest first, grouped by story

September 12, 2026

  • China-linked UNC3569 exploited Sogou Input Method CVE-2026-51990 to install GRAYRABBIT. Gen Threat Labs traced a clicked link through three weaknesses: sgbiz: argument injection, unrestricted navigation in a CEF webview, and an obsolete unsandboxed Chromium engine. The chain executed code with the logged-in user’s privileges. Tencent patched it within 12 days of the report. · Sep 12 · observed · Vulnerabilities & Active Exploitation