Story · 4 sources · 4 articlesfirst Sep 22, 09:01 UTCupdated Sep 23, 08:29 UTC (3d ago)

China-Linked UTA0565 Chained Chrome and Windows Zero-Days via Cloned Websites to Deploy CLEANGULP Backdoor

criticalThreat actorexploited in the wildimportance 92CVE-2026-85046 CVE-2026-87491 CVE-2026-85880

What's new: Compared with the previous summary, this merge adds technical detail from the underlying reports: CLEANGULP is an 893 KB obfuscated C backdoor that persists as MicrosoftIME.exe via a scheduled task and uses AES-256-GCM-encrypted HTTP C2; the typosquatted domain chinadigitaltimes[.]top is named; CVE-2026-85046 is characterized as a patch-gap flaw weaponized before its fix reached stable Chrome…

Merged summary · glm-5.3 · rewritten as coverage arrives

Volexity attributes a third Chinese espionage cluster, UTA0565, to September 3-4, 2026 attacks on Asian government entities that used cloned legitimate websites and the shared BlueMoon exploit kit to chain three zero-days (CVE-2026-85046, CVE-2026-87491,…

Volexity tracks a third China-linked espionage cluster, UTA0565, which on September 3-4, 2026 — before the flaws were disclosed or patched — targeted Asian government entities with phishing emails impersonating the Center for American Progress and themed around imprisoned Hong Kong activist Chow Hang-tung. Victims were lured to cloned, typosquatted versions of the Center for American Progress and China Digital Times websites (including chinadigitaltimes[.]top), where a hidden iframe loaded the BlueMoon exploit kit. The kit chained three zero-days: CVE-2026-85046, described as a Chrome V8 type-confusion patch-gap flaw that was fixed in Chromium source but not yet in stable Chrome, and CVE-2026-87491 — described as a V8 sandbox escape in one report and as a JavaScript-engine remote-code-execution flaw alongside CVE-2026-85046 in another — followed by CVE-2026-85880, a Windows Advanced Local Procedure Call (ALPC) kernel privilege-escalation zero-day that Microsoft disclosed on September 8, 2026, to escape the browser sandbox and gain full code execution. The final payload, CLEANGULP, is a previously undocumented 893 KB obfuscated C implant, described as MSVC-built, that persists as MicrosoftIME.exe via a scheduled task and supports shell commands, process enumeration, file upload/download, and beacon object file (BOF) execution, communicating over AES-256-GCM-encrypted HTTP with a C2 domain mimicking theconversation.com (thecovnresation[.]com). Proofpoint reports the shared BlueMoon exploit framework has at least four espionage users with a suspected China nexus — groups it has linked to APT31, UNK_LateNight, UNK_DoubleCheck, and UNK_QuietRacket — and Volexity assesses the kit's shared use reflects coordinated activity across multiple Chinese computer network exploitation groups with broader impact than currently observed.

Actor: UTA0565, a third Chinese-linked espionage cluster tracked by Volexity; all four reports agree on the actor, dates, targets, and CVEs
Attack window: September 3-4, 2026, before the vulnerabilities were disclosed or patched; Microsoft disclosed CVE-2026-85880 on September 8, 2026
Zero-day chain: CVE-2026-85046 and CVE-2026-87491 (Chromium) plus CVE-2026-85880 (Windows ALPC kernel privilege escalation)

VendorsGoogle Microsoft Google Chrome Microsoft Windows Volexity

ProductsChrome Chromium Windows

Threat actorsUTA0565 APT31 UNK_LateNight UNK_DoubleCheck UNK_QuietRacket

MalwareCLEANGULP

VictimsAsian government entities

OrganizationsUTA0565 Volexity Google Chrome Microsoft Windows

Coverage timelineoldest first · each row is one article

Sep 22, 09:01 UTC · 4d ago
GBHackers· 85
Chinese APT Clones Legitimate Websites to Deliver Chrome and Windows Zero-Day Exploits
Volexity links third Chinese actor UTA0565 to typosquatted phishing sites chaining Chrome and Windows zero-days to deploy CLEANGULP backdoor.
Sep 22, 11:25 UTC · 4d ago
Cyber Security News· 0
Hackers Clone Legitimate Websites to Silently Trigger Chrome and Windows Zero-Day Exploits
A cyber campaign uses cloned legitimate websites to trigger zero-day exploits in Chrome and Windows, targeting Asian government entities for espionage.
Sep 22, 18:47 UTC · 4d ago
CyberScoop· 88
Volexity spots another China-aligned threat group exploiting Chrome and Microsoft defects

Vulnerabilities in this storyAll →

CVE-2026-850468.849%
Actively Exploited V8 Type Confusion in Google Chrome (CVE-2026-85046)
published 23d ago· Google Chrome KEV PoC ×5
CVE-2026-85880

CVE	Vulnerability	CVSS	EPSS	Flags	Affected	Exposure	Published
CVE-2026-85046	Actively Exploited V8 Type Confusion in Google Chrome (CVE-2026-85046) Google Chrome versions prior to 152.0.7977.82 contain a type confusion flaw (CWE-843) in the V8 JavaScript engine, which mishandles object types during engine operations (public proof-of-concept writeups indicate it is reachable through array sorting and WebAssembly-related code paths). A remote attacker triggers the flaw simply by getting a user to open a crafted HTML page, with no privileges or authentication required. Successful exploitation lets the attacker execute arbitrary code inside the browser's sandbox, and public reporting shows it being chained with Windows zero-days (the 'BlueMoon' exploit kit) by Chinese espionage groups for broader compromise. Any user of an unpatched Chrome or another build embedding the affected V8 engine is exposed. The vulnerability is a zero-day that was actively exploited in the wild before patching, was added to CISA's KEV on 2026-09-04, and has five public proof-of-concept references. Do: Update Google Chrome to 152.0.7977.82 or later immediately, and apply the corresponding V8 fix in any Chromium-based browser in use. Federal agencies must apply mitigations in line with CISA BOD 26-04 and its cloud-services requirements, evaluating each asset's internet exposure. Because public reporting shows this flaw chained with Windows zero-days in 'BlueMoon' attacks, patch the related Windows vulnerabilities as well and hunt for signs of exploit-chain activity on high-exposure endpoints.	8.8	49%	KEV PoC ×5	Google Chrome prior to 152.0.7977.82 Google Chromium V8 V8 engine versions bundled with Chrome prior to 152.0.7977.82	massmultiple billions of users/installs (Chrome is the dominant desktop browser at roughly 65% market share, with an estimated 3+ billion active users, plus…	23d ago KEV Sep 4, 2026
CVE-2026-85880	Heap-Based Buffer Overflow in Windows ALPC Enables Local Privilege Escalation CVE-2026-85880 is a heap-based buffer overflow in Windows Advanced Local Procedure Call (ALPC), the Windows mechanism for local inter-process communication. An authorized local attacker can trigger the overflow by submitting crafted input over ALPC, corrupting heap memory in the component that handles the request. Successful exploitation allows the attacker to execute code with elevated privileges, typically gaining SYSTEM-level control of the local host, which is especially valuable as a post-exploitation or sandbox-escape step. Affected products include Windows 10 (1607, 1809, 21H2, 22H2) and Windows Server 2012, 2016, 2019, and 2022, meaning most on-premises Windows estates are in scope. The flaw was fixed in Microsoft's record 974-CVE September 2026 Patch Tuesday and was added to CISA's KEV on 2026-09-08, confirming exploitation in the wild; press reports describe Windows zero-days being chained with a Chrome zero-day in 'BlueMoon' kit attacks, though the data does not explicitly confirm this CVE is the Windows flaw in that chain. Do: Apply Microsoft's September 2026 security (cumulative) updates for each affected Windows 10 and Windows Server build, as no public PoC or workaround is documented; CISA's KEV listing (added 2026-09-08) triggers BOD 26-04 patching requirements for federal agencies, so prioritize accordingly. Give priority to hosts where unprivileged users can log in — RDS/VDI servers, jump boxes, shared workstations — and to internet-exposed Windows servers, since an ALPC local privilege escalation is a common component in exploit chains combining remote code execution or browser flaws with elevation to SYSTEM. Organizations unable to patch promptly should follow BOD 26-04 guidance for cloud services or restrict local access to affected hosts until updates are applied.	7.8	4%	KEV
CVE-2026-87491	Actively Exploited Out-of-Bounds Write in Google Chrome V8 CVE-2026-87491 is an out-of-bounds write (CWE-787) in the V8 JavaScript engine in Google Chrome, fixed in Chrome 153.0.8010.36, which Google shipped alongside roughly 230 other security fixes. An attacker can trigger the flaw remotely by luring a user (user interaction required) into opening a crafted HTML page that corrupts memory in V8. Successful exploitation allows the attacker to execute arbitrary code inside the Chrome browser sandbox, which constrains but does not eliminate the impact. All Google Chrome users running versions prior to 153.0.8010.36 are affected; because the flaw resides in V8, CISA tracks it as 'Google Chromium V8', and other Chromium-based browsers may inherit the fix in their own updates. The flaw is being actively exploited in the wild — it is the seventh actively exploited Chrome zero-day of 2026 and was added to CISA's KEV catalog on 2026-09-09 — though no public proof-of-concept is known and ransomware use is unknown. Do: Update Google Chrome to 153.0.8010.36 or later immediately (open Help > About Google Chrome to force the update and relaunch), and verify the version on all endpoints. Also patch headless or automated Chrome deployments (CI runners, scrapers, kiosks, CDP-based tooling) that may lag auto-updates, and prioritize remediation per CISA KEV and BOD 26-04 requirements for federal systems. No public PoC is known and ransomware use is unknown, but confirmed in-the-wild exploitation warrants urgent patching.	8.8	3%	KEV	Google Chrome (V8 JavaScript engine; tracked by CISA as 'Google Chromium V8') prior to 153.0.8010.36

CVE

Vulnerability

CVSS

EPSS

Flags

Affected

Exposure

Published

CVE-2026-85046

Actively Exploited V8 Type Confusion in Google Chrome (CVE-2026-85046)

Google Chrome versions prior to 152.0.7977.82 contain a type confusion flaw (CWE-843) in the V8 JavaScript engine, which mishandles object types during engine operations (public proof-of-concept writeups indicate it is reachable through array sorting and WebAssembly-related code paths). A remote attacker triggers the flaw simply by getting a user to open a crafted HTML page, with no privileges or authentication required. Successful exploitation lets the attacker execute arbitrary code inside the browser's sandbox, and public reporting shows it being chained with Windows zero-days (the 'BlueMoon' exploit kit) by Chinese espionage groups for broader compromise. Any user of an unpatched Chrome or another build embedding the affected V8 engine is exposed. The vulnerability is a zero-day that was actively exploited in the wild before patching, was added to CISA's KEV on 2026-09-04, and has five public proof-of-concept references.

Do: Update Google Chrome to 152.0.7977.82 or later immediately, and apply the corresponding V8 fix in any Chromium-based browser in use. Federal agencies must apply mitigations in line with CISA BOD 26-04 and its cloud-services requirements, evaluating each asset's internet exposure. Because public reporting shows this flaw chained with Windows zero-days in 'BlueMoon' attacks, patch the related Windows vulnerabilities as well and hunt for signs of exploit-chain activity on high-exposure endpoints.

8.8

49%

KEV PoC ×5

Google Chrome prior to 152.0.7977.82
Google Chromium V8 V8 engine versions bundled with Chrome prior to 152.0.7977.82

massmultiple billions of users/installs (Chrome is the dominant desktop browser at roughly 65% market share, with an estimated 3+ billion active users, plus…

23d ago

KEV Sep 4, 2026

CVE-2026-85880

Heap-Based Buffer Overflow in Windows ALPC Enables Local Privilege Escalation

CVE-2026-85880 is a heap-based buffer overflow in Windows Advanced Local Procedure Call (ALPC), the Windows mechanism for local inter-process communication. An authorized local attacker can trigger the overflow by submitting crafted input over ALPC, corrupting heap memory in the component that handles the request. Successful exploitation allows the attacker to execute code with elevated privileges, typically gaining SYSTEM-level control of the local host, which is especially valuable as a post-exploitation or sandbox-escape step. Affected products include Windows 10 (1607, 1809, 21H2, 22H2) and Windows Server 2012, 2016, 2019, and 2022, meaning most on-premises Windows estates are in scope. The flaw was fixed in Microsoft's record 974-CVE September 2026 Patch Tuesday and was added to CISA's KEV on 2026-09-08, confirming exploitation in the wild; press reports describe Windows zero-days being chained with a Chrome zero-day in 'BlueMoon' kit attacks, though the data does not explicitly confirm this CVE is the Windows flaw in that chain.

Do: Apply Microsoft's September 2026 security (cumulative) updates for each affected Windows 10 and Windows Server build, as no public PoC or workaround is documented; CISA's KEV listing (added 2026-09-08) triggers BOD 26-04 patching requirements for federal agencies, so prioritize accordingly. Give priority to hosts where unprivileged users can log in — RDS/VDI servers, jump boxes, shared workstations — and to internet-exposed Windows servers, since an ALPC local privilege escalation is a common component in exploit chains combining remote code execution or browser flaws with elevation to SYSTEM. Organizations unable to patch promptly should follow BOD 26-04 guidance for cloud services or restrict local access to affected hosts until updates are applied.

7.8

KEV

CVE-2026-87491

Actively Exploited Out-of-Bounds Write in Google Chrome V8

CVE-2026-87491 is an out-of-bounds write (CWE-787) in the V8 JavaScript engine in Google Chrome, fixed in Chrome 153.0.8010.36, which Google shipped alongside roughly 230 other security fixes. An attacker can trigger the flaw remotely by luring a user (user interaction required) into opening a crafted HTML page that corrupts memory in V8. Successful exploitation allows the attacker to execute arbitrary code inside the Chrome browser sandbox, which constrains but does not eliminate the impact. All Google Chrome users running versions prior to 153.0.8010.36 are affected; because the flaw resides in V8, CISA tracks it as 'Google Chromium V8', and other Chromium-based browsers may inherit the fix in their own updates. The flaw is being actively exploited in the wild — it is the seventh actively exploited Chrome zero-day of 2026 and was added to CISA's KEV catalog on 2026-09-09 — though no public proof-of-concept is known and ransomware use is unknown.

Do: Update Google Chrome to 153.0.8010.36 or later immediately (open Help > About Google Chrome to force the update and relaunch), and verify the version on all endpoints. Also patch headless or automated Chrome deployments (CI runners, scrapers, kiosks, CDP-based tooling) that may lag auto-updates, and prioritize remediation per CISA KEV and BOD 26-04 requirements for federal systems. No public PoC is known and ransomware use is unknown, but confirmed in-the-wild exploitation warrants urgent patching.

8.8

KEV

Google Chrome (V8 JavaScript engine; tracked by CISA as 'Google Chromium V8') prior to 153.0.8010.36