China's UTA0565 Chains Chrome and Windows Zero-Days to Drop CLEANGULP

Volexity researchers Damien Cash and Tom Lancaster have detailed a campaign by a Chinese threat actor tracked as UTA0565 that exploited a recently disclosed Google Chrome and Microsoft Windows exploit chain while it was still a zero-day. The attacks were spotted on September 3 and 4, 2026.

The exploit chain

The operation combined two Chrome flaws (CVE-2026-85046 and CVE-2026-87491) with one in the Windows Advanced Local Procedure Call subsystem (CVE-2026-85880). Together they allowed the attackers to break out of the browser sandbox and achieve remote code execution. According to the researchers, the intrusion relied on the BlueMoon exploit kit bundling all three bugs, with a final "pp" shellcode fetching an executable named chrome_cleanup.exe.

Fake sites instead of the usual lures

What set UTA0565 apart was its reliance on multiple bogus websites. The group impersonated media organizations and a non-governmental organization. In one campaign it targeted Asian government entities with Chinese- and English-language phishing emails urging recipients to support Hong Kong activist Chow Hang-tung — sentenced this month to seven years and three months — while posing as the Center for American Progress.

The links pointed to chinadigitaltimes[.]top and americanprgoress[.]top, which mimicked China Digital Times and CAP. A hidden iframe loaded an element called config.html that triggered the exploit.

The CLEANGULP backdoor

The delivered payload is a new malware family dubbed CLEANGULP, built with the Microsoft Visual C Compiler. It can run shell commands, list processes, upload and download files, and execute a beacon object file (BOF). For command and control it reaches out over HTTP to a hard-coded domain, thecovnresation[.]com — a typo squatting on theconversation[.]com, an outlet known for academic analysis.

Volexity notes the same toolkit has surfaced with several actors, pointing to a coordinated effort within the Chinese CNE community: the core kit appears to be shared, customized, and weaponized by multiple groups. The findings so far cover only two affected organizations, so the true scope is likely far broader.

Source: The Hacker News