Volexity spots another China-aligned threat group exploiting Chrome and Microsoft defects
Volexity says China-linked UTA0565 exploited Chrome and Windows zero-days against Asian governments.
Volexity said China-aligned UTA0565 exploited three zero-days in Chrome and Windows on September 3-4, 2026, before the flaws were disclosed or patched. CVE-2026-85046 and CVE-2026-87491 are remote-code-execution bugs in Chromium's JavaScript engine, and CVE-2026-85880 is a Windows Advanced Local Procedure Call privilege-escalation zero-day Microsoft disclosed on September 8. The group emailed Asian government entities with lures about imprisoned Hong Kong activist Chow Hang-tung and spoofed domains impersonating the Center for American Progress and China Digital Times, deploying previously undocumented malware CLEANGULP. Volexity said the same exploit kit was shared across Chinese groups that Proofpoint has linked to APT31, UNK_LateNight, UNK_DoubleCheck, and UNK_QuietRacket.
- UTA0565 exploited the bugs on September 3-4 before patches
- Two Chromium JavaScript RCE flaws and one Windows ALPC bug
- Phish lured Asian officials using spoofed advocacy and news sites
- Payload family CLEANGULP; kit shared among Chinese espionage groups
- Proofpoint earlier linked the chain to APT31 and UNK clusters
- ATT&CK
- T1566.002 Spearphishing LinkT1203 Exploitation for Client ExecutionT1068 Exploitation for Privilege EscalationT1583.001 Acquire Infrastructure: Domains
- Malware
- CLEANGULP
- Victims
- Asian government entities
- Organizations
- VolexityProofpoint
- Countries
- China
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-85046 | Actively Exploited V8 Type Confusion in Google Chrome (CVE-2026-85046) | 8.8 | 2% | KEVPoC ×6 | KEV |
| CVE-2026-85880 | Heap-Based Buffer Overflow in Windows ALPC Enables Local Privilege Escalation | 7.8 | <1% | KEV | KEV |
| CVE-2026-87491 | Actively Exploited Out-of-Bounds Write in Google Chrome V8 | 8.8 | 4% | KEV | KEV |
From the original article
3 min read at cyberscoop.com
The threat group Volexity tracks as UTA0565 showcased a variance in tactics, but it used the same exploit kit as multiple Chinese threat groups. The post Volexity spots another China-aligned threat group exploiting Chrome and Microsoft defects appeared first on CyberScoop.
By Matt Kapko · cyberscoop.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.