UTA0565 exploited a Chrome-Windows zero-day chain through fake websites to deploy CLEANGULP malware against Asian government entities.

UTA0565 exploited a Chrome-Windows zero-day chain through fake websites to deploy CLEANGULP malware against Asian government entities.

The threat group Volexity tracks as UTA0565 showcased a variance in tactics, but it used the same exploit kit as multiple Chinese threat groups.

UTA0565 exploited a Chrome-Windows zero-day chain through fake websites to deploy CLEANGULP malware against Asian government entities.

At a Glance Attribute Details Actor or Group UTA0565 (suspected Chinese state-sponsored espionage group) Activity Type Spear-phishing, zero-day exploit chaining, website spoofing Targets or Victims Asian government agencies, think tanks, policy institutes Scale Targeted espionage operations across Asia and the United States Jurisdiction / Status Suspected Chinese cyber espionage group; uncharged Source Volexity Threat Research (supported by Proofpoint findings) Executive Summary…

A Chinese threat actor codenamed UTA0565 has been observed exploiting the recently disclosed Google Chrome-Microsoft Windows exploit chain as zero-days through fake websites. The attacks, detected on September 3 and 4, 2026, involved the chaining of two vulnerabilities in Chrome (CVE-2026-85046, CVE-2026-87491) and one impacting Windows Advanced Local Procedure Call (CVE-2026-85880) to break

Ubuntu Linux Use-After-Free Enables Host-Root Container Escape · Chinese UTA0565 Uses Chrome-Windows Zero-Days for CLEANGULP · Process Parameter Poisoning EDR Evasion Technique

UTA0565 exploited a Chrome-Windows zero-day chain through fake websites to deploy CLEANGULP malware against Asian government entities.

Sicherheitsforscher haben eine Cyberspionage-Kampagne der mutmaßlich chinesischen Gruppe UTA0565 aufgedeckt, die eine Kette bislang unbekannter Schwachstellen in Google Chrome und Microsoft Windows ausnutzte, um Regierungsstellen in Asien anzugreifen. Über gefälschte Websites setzten die Angreifer die zuvor undokumentierte Malware CLEANGULP ein.Angriffskette aus drei Zero-Day-LückenDie Angriffe wurden Anfang September entdeckt und kombiniert drei Schwachstellen: CVE-2026-85046 und CVE-2026-87491 […] The post Chrome und Windows: UTA0565 nutzt drei Zero-Day-Lücken für Spionage appeared first on BornCity.

20 curated cybersecurity & geopolitical intel stories. Nation-state ops, threat intel, policy & vulnerabilities.

UTA0565がChrome-Windowsのゼロデイチェーンを偽サイト経由で悪用し、アジア太平洋地域の政府機関にCLEANGULPマルウェアを配置。重大な脆弱性を利用した標的型攻撃。

Curate Feeds | Make Collections | Customize Email Briefs

Curate Feeds | Make Collections | Customize Email Briefs

Volexity found the Chinese threat group UTA0565 exploiting a chain of zero-day vulnerabilities in Chrome and Microsoft products across multiple phishing campaigns. The group used fake websites, spoofed domains, and a previously undocumented malware family called CLEANGULP to target Asian government entities and other organizations. #UTA0565 #CVE-2026-85046 #CVE-2026-87491 #CVE-2026-85880 #CLEANGULP #Chow_Hang-tung

A Chinese threat actor codenamed UTA0565 has been observed exploiting the recently disclosed Google Chrome-Microsoft Windows exploit chain as zero-days through fake websites. The attacks, detected on September 3 and 4, 2026, involved the chaining of two vulnerabilities in Chrome (CVE-2026-85046, CVE-2026-87491) and one impacting Windows Advanced Local Procedure Call (CVE-2026-85880) to break

https://www.osintinvestigate.com A Chinese-linked threat actor known as UTA0565 has been observed exploiting a Chrome-Windows zero-day chain to deliver CLEANGULP malware. The attacks, detected on September 3 and 4, 2026, combined two Google Chrome vulnerabilities and a Windows ALPC flaw to escape the browser sandbox and achieve remote code execution. The campaign used phishing emails, fake websites, hidden iframes, and impersonated media organizations and NGOs to deceive targeted victims. In this episode, we examine how the BlueMoon exploit chain was used, how CLEANGULP operates, and why the reuse of the same exploit kit across multiple threat actors is attracting attention from cybersecurity researchers.

The threat group Volexity tracks as UTA0565 showcased a variance in tactics, but it used the same exploit kit as multiple Chinese threat groups.

Onderzoekers van Volexity hebben een door de staat gesteunde Chinese dreigingsgroep, aangeduid als UTA0565, ontdekt die tussen 3 en 4 september 2026 drie zero-day kwetsbaarheden in Chrome en Microsoft uitbuitte. Deze misbruikacties vonden plaats voordat de kwetsbaarheden publiekelijk bekend waren of konden worden gepatcht. De timing van deze activiteiten valt samen met andere waargenomen pieken van kwaadaardige activiteiten die door dreigingsjagers worden toegeschreven aan Chinese spionagegroepen. UTA0565 gebruikte meerdere valse websites om slachtoffers te misleiden, een afwijkende tactiek ten opzichte van soortgelijke aanvallen. Daarnaast werd het gebruik van echte inhoud van legitieme we...