Full Report
A Chinese threat actor codenamed UTA0565 has been observed exploiting the recently disclosed Google Chrome-Microsoft Windows exploit chain as zero-days through fake websites. The attacks, detected on September 3 and 4, 2026, involved the chaining of two vulnerabilities in Chrome (CVE-2026-85046, CVE-2026-87491) and one impacting Windows Advanced Local Procedure Call (CVE-2026-85880) to break
Analysis Summary
# Threat Actor: UTA0565
## Attribution & Identity
* **Identification:** UTA0565 is a Chinese threat actor.
* **Known Associations:** The actor is part of a broader Chinese Computer Network Exploitation (CNE) community. The "BlueMoon" exploit kit used by this actor has been linked to at least four other spy groups, suggesting shared development or distribution of exploit tooling among Chinese state-linked entities.
## Activity Summary
In early September 2026, UTA0565 conducted a high-sophistication campaign utilizing an exploit chain consisting of two Google Chrome zero-days and one Windows zero-day. The campaign involved the creation of multiple fake websites masquerading as NGOs and media outlets to deliver malware to specific targets via phishing emails.
## Tactics, Techniques & Procedures
* **Zero-Day Exploitation:** Chaining browser and OS vulnerabilities to achieve sandbox escape and Remote Code Execution (RCE).
* **CVE-2026-85046** (Chrome)
* **CVE-2026-87491** (Chrome)
* **CVE-2026-85880** (Windows Advanced Local Procedure Call)
* **Phishing & Social Engineering:** Sending spoofed emails (in Chinese and English) leveraging topical political issues (e.g., support for activist Chow Hang-tung).
* **Typosquatting/Masquerading:** Creating domains that mimic legitimate organizations (Center for American Progress, China Digital Times).
* **Malicious Iframes:** Using hidden iframes to load the "BlueMoon" exploit kit via `config.html`.
* **Execution:** Deploying a custom C++ executable via shellcode.
* **Command and Control (C2):** Utilizing HTTP-based C2 with hard-coded domains designed to blend in with legitimate media traffic.
## Targeting
* **Sectors:** Government entities, Non-Governmental Organizations (NGOs), Media.
* **Geography:** Primarily focused on Asia.
* **Victims:** Asian government entities; entities interested in or associated with Hong Kong activism and the Center for American Progress (CAP).
## Tools & Infrastructure
* **Malware:**
* **CLEANGULP:** A C++ based malware capable of running shell commands, listing processes, uploading/downloading files, and executing Beacon Object Files (BOF).
* **BlueMoon Exploit Kit:** A shared exploit framework used for initial compromise.
* **Payload Filename:** `chrome_cleanup.exe`
* **Infrastructure:**
* `chinadigitaltimes[.]top` (Masquerading as China Digital Times)
* `americanprgoress[.]top` (Masquerading as Center for American Progress)
* `thecovnresation[.]com` (C2 domain masquerading as theconversation.com)
## Implications
The use of a sophisticated three-part zero-day chain indicates a high level of resourcing and technical capability. The sharing of the "BlueMoon" kit across multiple threat actors suggests a centralized "digital quartermaster" or collaborative exploit development environment within Chinese intelligence services. This increased availability of zero-days to multiple groups expands the threat surface for government and civil society targets significantly.
## Mitigations
* **Patch Management:** Immediate application of security updates for Google Chrome and Microsoft Windows to address the mentioned CVEs.
* **Browser Hardening:** Implement browser sandboxing enhancements and restrict the execution of unauthorized scripts.
* **Email Security:** Deploy advanced phishing protection to identify and block typosquatted domains and spoofed sender addresses.
* **Network Monitoring:** Monitor for outbound HTTP traffic to the identified C2 domains and look for unusual process executions (e.g., `chrome_cleanup.exe`).
* **Endpoint Detection:** Use EDR solutions to detect the execution of Beacon Object Files (BOF) and unauthorized shell commands.