Chinese APT Clones Legitimate Websites to Deliver Chrome and Windows Zero-Day Exploits
Volexity links third Chinese actor UTA0565 to typosquatted phishing sites chaining Chrome and Windows zero-days to deploy CLEANGULP backdoor.
Volexity attributes a third Chinese-linked espionage cluster, UTA0565, to September 2026 phishing operations against Asian government entities using cloned sites like chinadigitaltimes[.]top. Hidden iframes chained Chrome V8 type confusion CVE-2026-85046 (a patch-gap flaw fixed in Chromium source but not yet in stable Chrome), V8 sandbox escape CVE-2026-87491, and Windows kernel LPE CVE-2026-85880 for full code execution. The final payload, CLEANGULP, is an 893 KB obfuscated C backdoor persisting as MicrosoftIME.exe via a scheduled task, with shell, file transfer, process enumeration, and BOF commands over AES-256-GCM encrypted HTTP C2. Proofpoint reports the shared BlueMoon exploit framework has at least four espionage users with a suspected China nexus, indicating rapid spread of the capability.
- UTA0565 chained zero-days CVE-2026-85046, CVE-2026-87491, CVE-2026-85880 while Chrome remained unpatched
- Typosquatted clones of China Digital Times and Center for American Progress hosted hidden exploit iframes
- CLEANGULP backdoor persists via MicrosoftIME scheduled task and uses AES-256-GCM HTTP C2
- Shared BlueMoon exploit framework now used by at least four China-nexus espionage operators
- Patch-gap CVE-2026-85046 was weaponized before the fix reached stable Chrome builds
- ATT&CK
- T1566.002 Spearphishing LinkT1203 Exploitation for Client ExecutionT1036.005 Match Legitimate Name or LocationT1053.005 Scheduled Task/JobT1071.001 Web Protocols
- Threat actors
- APT31
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-85046 | Actively Exploited V8 Type Confusion in Google Chrome (CVE-2026-85046) | 8.8 | 2% | KEVPoC ×6 | KEV |
| CVE-2026-85880 | Heap-Based Buffer Overflow in Windows ALPC Enables Local Privilege Escalation | 7.8 | <1% | KEV | KEV |
| CVE-2026-87491 | Actively Exploited Out-of-Bounds Write in Google Chrome V8 | 8.8 | 4% | KEV | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | americanprgoress.top | digitaltimes[.]top , impersonating China Digital Times, and americanprgoress[.]top , a typosquat of americanprogress[.]org . Volexity found |
| domain | americanprogress.org | Digital Times, and americanprgoress[.]top , a typosquat of americanprogress[.]org . Volexity found that the China Digital Times lure had be |
| domain | borneobulletins.top | outsourcingwise[.]net , halal-navi[.]net , halaltak[.]net , borneobulletins[.]top , and both thecovnresation[.]net and thecovnresation[.]co |
| domain | chinadigitaltimes.top | semble legitimate organizations. Observed examples included chinadigitaltimes[.]top , impersonating China Digital Times, and americanprgoress |
| domain | halal-navi.net | 5 with medium confidence, including outsourcingwise[.]net , halal-navi[.]net , halaltak[.]net , borneobulletins[.]top , and both theco |
| domain | halaltak.net | dence, including outsourcingwise[.]net , halal-navi[.]net , halaltak[.]net , borneobulletins[.]top , and both thecovnresation[.]net |
| domain | outsourcingwise.net | kalike domains to UTA0565 with medium confidence, including outsourcingwise[.]net , halal-navi[.]net , halaltak[.]net , borneobulletins[.]t |
| domain | thecovnresation.com | nce and follow-on operations. The malware communicates with thecovnresation[.]com , a typosquat of media network The Conversation. It uses |
| domain | thecovnresation.net | i[.]net , halaltak[.]net , borneobulletins[.]top , and both thecovnresation[.]net and thecovnresation[.]com . These domains impersonate med |
| ipv4 | 96.9.125.52 | found that the China Digital Times lure had been hosted on 96.9.125[.]52 and closely replicated the authentic site’s appearance. T |
| sha256 | 8858ea412dc306b3558885af18006c5ca24689e8875733b5e13b3c2692e603cb | eanup.exe , is a 893 KB 64-bit executable with SHA-256 hash 8858ea412dc306b3558885af18006c5ca24689e8875733b5e13b3c2692e603cb . Volexity identified it as CLEANGULP, a previously undocum |
From the original article
3 min read at gbhackers.com
A third Chinese threat actor has been linked to phishing campaigns that cloned trusted websites and chained Chrome and Windows zero-day exploits to deploy a previously undocumented backdoor. The activity occurred on September 3 and 4, 2026, while the targeted vulnerabilities remained unpatched in Google Chrome. It followed Volexity’s September 9 disclosure that UTA0560 and […]
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.