Hackers Clone Legitimate Websites to Silently Trigger Chrome and Windows Zero-Day Exploits
AI summary · glm-5.3Summaries by Vani AI
A cyber campaign uses cloned legitimate websites to trigger zero-day exploits in Chrome and Windows, targeting Asian government entities for espionage.
A cyber campaign uses cloned legitimate websites to trigger zero-day exploits in Chrome and Windows, targeting Asian government entities with espionage intent, and involves CLEANGULP malware.
Key facts
- A phishing campaign uses cloned websites to trigger zero-day exploits in Chrome and Windows
- Activity targeted Asian government entities with espionage intent
- Exploited flaws in Chrome, Windows, and CLEANGULP malware
- Products
- Chrome
- Threat actors
- UTA0565
- Malware
- CLEANGULP
- Victims
- Asian government entities
- Organizations
- China Digital TimesCenter for American Progress
- Countries
- China
- AI models
- OpenAI
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | americanprgoress.top | site designed to imitate China Digital Times Spoofed domain americanprgoress[.]top Typosquatted domain impersonating the Center for American |
| domain | borneobulletins.top | omain resembling The Conversation Suspected attacker domain borneobulletins[.]top Typosquatted infrastructure linked to similar campaigns N |
| domain | chinadigitaltimes.top | mpromise (IoCs):- Type Indicator Description Spoofed domain chinadigitaltimes[.]top Attacker-controlled domain impersonating China Digital Ti |
| domain | halal-navi.net | cture linked to similar campaigns Suspected attacker domain halal-navi[.]net Typosquatted infrastructure linked to similar campaigns S |
| domain | halaltak.net | cture linked to similar campaigns Suspected attacker domain halaltak[.]net Typosquatted infrastructure linked to similar campaigns S |
| domain | outsourcingwise.net | sed as linked to UTA0565 activity Suspected attacker domain outsourcingwise[.]net Typosquatted infrastructure linked to similar campaigns S |
| domain | personclouds.com | value used to derive the AES key Suspected attacker domain personclouds[.]com Additional domain assessed as linked to UTA0565 activity |
| domain | thecovnresation.com | rosoftIME Persistence mechanism used by CLEANGULP C2 domain thecovnresation[.]com Hardcoded CLEANGULP command-and-control server C2 endpoin |
| domain | thecovnresation.net | cture linked to similar campaigns Suspected attacker domain thecovnresation[.]net Additional typosquatted domain resembling The Conversatio |
| ipv4 | 96.9.125.52 | domain impersonating China Digital Times Hosting IP address 96.9.125[.]52 Hosted a website designed to imitate China Digital Times |
| md5 | 177652713dad3c128bd9195abf2b7603 | ded exploit binary File name p2 Embedded exploit binary MD5 177652713dad3c128bd9195abf2b7603 Hash for the payload SHA-1 668aa5551315ab26b67118fbb29f8e45 |
| sha1 | 668aa5551315ab26b67118fbb29f8e4560a1e1af | 177652713dad3c128bd9195abf2b7603 Hash for the payload SHA-1 668aa5551315ab26b67118fbb29f8e4560a1e1af Hash for the payload SHA-256 8858ea412dc306b3558885af18006c |
| sha256 | 8858ea412dc306b3558885af18006c5ca24689e8875733b5e13b3c2692e603cb | 15ab26b67118fbb29f8e4560a1e1af Hash for the payload SHA-256 8858ea412dc306b3558885af18006c5ca24689e8875733b5e13b3c2692e603cb Hash for the payload File path %LOCALAPPDATA%\Microsoft\IME |
| sha256 | cbeeb7dd5e89261cde032825fd10bb80bad2e3fbf5b91fdc9137ad463ffa8f21 | ister Initial malware registration path Encryption key hash cbeeb7dd5e89261cde032825fd10bb80bad2e3fbf5b91fdc9137ad463ffa8f21 SHA-256 value used to derive the AES key Suspected attacker |
| url | https://americanprgoress.top/chrome_cleanup.exe | mpersonating the Center for American Progress Malicious URL hxxps://americanprgoress[.]top/chrome_cleanup.exe Payload delivery location Hidden iframe resource /config. |
From the original article
4 min read at cybersecuritynews.com
Hackers are using convincing copies of trusted websites to turn an ordinary browser visit into a full Windows compromise. The campaign pairs targeted phishing emails with a chained set of previously unknown flaws in Google Chrome and Microsoft Windows, giving attackers a quiet path from a fake page to malware on a victim’s device. The […]
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.