UTA0565 exploited a Chrome-Windows zero-day chain through fake websites to deploy CLEANGULP malware against Asian government entities.

UTA0565 exploited a Chrome-Windows zero-day chain through fake websites to deploy CLEANGULP malware against Asian government entities.

UTA0565がChrome-Windowsのゼロデイチェーンを偽サイト経由で悪用し、アジア太平洋地域の政府機関にCLEANGULPマルウェアを配置。重大な脆弱性を利用した標的型攻撃。

Haz clic para acceder al contenido completo.

https://www.osintinvestigate.com A Chinese-linked threat actor known as UTA0565 has been observed exploiting a Chrome-Windows zero-day chain to deliver CLEANGULP malware. The attacks, detected on September 3 and 4, 2026, combined two Google Chrome vulnerabilities and a Windows ALPC flaw to escape the browser sandbox and achieve remote code execution. The campaign used phishing emails, fake websites, hidden iframes, and impersonated media organizations and NGOs to deceive targeted victims. In this episode, we examine how the BlueMoon exploit chain was used, how CLEANGULP operates, and why the reuse of the same exploit kit across multiple threat actors is attracting attention from cybersecurity researchers.

Chinese hackers used a combined Chrome and Windows zero-day chain to execute remote code.

Volexity found the Chinese threat group UTA0565 exploiting a chain of zero-day vulnerabilities in Chrome and Microsoft products across multiple phishing campaigns. The group used fake websites, spoofed domains, and a previously undocumented malware family called CLEANGULP to target Asian government entities and other organizations. #UTA0565 #CVE-2026-85046 #CVE-2026-87491 #CVE-2026-85880 #CLEANGULP #Chow_Hang-tung

Curate Feeds | Make Collections | Customize Email Briefs