A third Chinese APT ran the same Chrome and Windows zero-day chain from spoofed news sites
Volexity dates UTA0565's exploitation to September 3 and 4, five to six days before it first reported the chain publicly, delivered from typosquats of China Digital Times and the Center for American Progress and ending in a new implant it calls CLEANGULP.
The Watch · Security desk
What happened
- Volexity says a third Chinese threat actor, which it tracks as UTA0565, used the same chained Chrome and Windows zero-day exploits on September 3 and 4, 2026.
- The chain is CVE-2026-85046 and CVE-2026-87491 in Chrome plus CVE-2026-85880 on Windows, and Volexity reported two other Chinese APT actors using it on September 9.
- One campaign sent Asian government entities a Chinese-language email urging support for imprisoned Hong Kong activist Chow Hang-tung; another impersonated the Center for American Progress.
- The lures linked to actor-controlled lookalike domains, including one on 96.9.125.52 that Censys showed had served a copy of the China Digital Times site.
- The chain ended in chrome_cleanup.exe, a previously undocumented family Volexity names CLEANGULP, which beacons to a single hardcoded domain typosquatting The Conversation.
Why it matters
- Who's exposed exposure Anyone who opened one of those links on September 3 or 4 was exploited before a fix existed, so a clean patch-compliance report says nothing about whether that host is compromised.
- Who has to decide decision Responders who scoped their hunt to the indicators published on September 9 now have to push the search window back to September 3 and re-run it against the UTA0565 domains.
- What's now possible capability A packaged chain that three separate actors ran with only cosmetic edits means exploit development is no longer the gate on who can go from a browser visit to privileged code on Windows.
- What it limits constraint The C2 traffic is plain HTTP to a domain that impersonates a news publisher, so category-based web filtering and reputation lists are poorly placed to catch the callback.
Next story · Security · Sep 14
A reflected XSS on a US university site launched a three-CVE Chrome chain at NGOsConfirmed2 publishers
americanprgoress[.]top pulled most of its content from the real Center for American Progress site, then added one element of its own: an iframe set to zero width, zero height and display:none, loading /config.html [8]. Volexity says config.html holds the same components as the Chrome and Windows exploits it had already analysed, with the implementation largely unchanged [9]. The edits are cosmetic apart from the payload swap: renamed variables, debug messages, comments, and an option to log data to an internal IP address [10].
That puts three Chinese APT actors on one exploit kit inside a week, with the third actor's copy differing from the earlier two mainly in what it drops [4][1][10]. Volexity did not disclose where the kit came from.
Volexity puts UTA0565's exploitation on September 3 and 4 [1] and published its first report on the chain on September 9 [4], so the earliest confirmed use of these three CVEs ran five to six days ahead of the first public warning [19]. Volexity says the vulnerabilities were still unpatched when UTA0565 used them [2].
The final binary, chrome_cleanup.exe, came from the same typosquat that served the exploit [11]. It is the first documented sample of a family Volexity calls CLEANGULP: C code built with Microsoft's Visual C compiler, then heavily obfuscated with control flow flattening and indirect calls [12]. Volexity worked it through dynamic analysis, locating and emulating its string de-obfuscation functions, and rates the resulting capability list high confidence on partial analysis [13].
The network indicators are easy to collect. This CLEANGULP instance calls one hardcoded C2 domain, thecovnresation[.]com, a typosquat of The Conversation [14], and every flow Volexity observed used HTTP [15]. The first beacon is a POST to /beacon/pre-register whose user agent stops at AppleWebKit/537.36, with no browser or version token after it [16]. The session identifier in the registration body does not conform to RFC 9562; it is time-based [18].
Bodies are AES-256-GCM encrypted, then Base64 encoded with a custom alphabet, and the AES key is the SHA256 of that alphabet string [17]. Volexity published both the alphabet and the resulting key, cbeeb7dd5e89261cde032825fd10bb80bad2e3fbf5b91fdc9137ad463ffa8f21 [17]. Anyone holding September packet captures of traffic to that domain can decrypt the beacons now.
What to watch
- Patch dates for CVE-2026-85046, CVE-2026-87491 and CVE-2026-85880 from Google or Microsoft. Those dates would fix the real length of the pre-patch window.
- A fourth actor turning up with the same config.html kit, or any vendor naming who built and distributed it.
- CLEANGULP appearing with a different C2 or a non-HTTP channel; either would retire the current network indicators.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence72
- Adoption58
- Hype gap+8
- Incentives52
- Confidence64
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Volexity discovered additional campaigns from a third Chinese threat actor, tracked under the alias UTA0565, that used the same chained exploits on September 3-4, 2026.
- [2]
The vulnerabilities were still unpatched when UTA0565 used them on September 3-4, 2026, according to Volexity.
- [3]
UTA0565's campaigns differed from previously documented attacks by using multiple fake websites to deceive victims.
- [4]
On September 9, 2026, Volexity published a blog post detailing the simultaneous use of multiple chained zero-day exploits in Google Chrome (CVE-2026-85046, CVE-2026-87491) and Microsoft Windows (CVE-2026-85880) by two different Chinese advanced persistent threat actors.
- [5]
In one observed campaign a Chinese-language phishing email was sent to Asian government entities urging readers to publicly support imprisoned Hong Kong activist Chow Hang-tung and amplify her voice against Chinese Communist Party suppression of a June 4th commemoration.
- [6]
In another campaign the threat actor sent a phishing email masquerading as the Center for American Progress, and each phishing email included a link to a spoofed domain registered and controlled by the threat actor.
- [7]
The fake website spoofing the China Digital Times was no longer available at the time of analysis, but searches within Censys showed the hosting IP address 96.9.125[.]52 had served a website designed to look identical to the legitimate China Digital Times website.
- [8]
The spoofed site americanprgoress[.]top, a typosquat impersonating the Center for American Progress, was still live at the time of analysis; it loaded most of its content from the legitimate website and also loaded an additional HTML element via an iframe pointing to /config.html with display:none, visibility:hidden, width:0 and height:0.
- [9]
The config.html element consists of the same components used in previously analyzed exploitation of Chrome (CVE-2026-85046, CVE-2026-87491) and the Windows local privilege escalation exploit (CVE-2026-85880), and the implementation is largely unchanged.
- [10]
The main functional difference in this version is the replacement payload; other changes do not affect the exploit kit's operation and include renamed variables, debug messages, comments, and an option to log data to an internal IP address.
- [11]
The chain downloaded its final payload from hxxps://americanprgoress[.]top/chrome_cleanup.exe.
- [12]
The payload belongs to a previously undocumented malware family Volexity tracks as CLEANGULP, originally written in C and built using the Microsoft Visual C Compiler, then heavily obfuscated using control flow flattening and indirect calls to hinder analysis.
- [13]
Volexity analyzed CLEANGULP primarily through dynamic analysis, locating and emulating string de-obfuscation functions, and based on that partial analysis assesses with high confidence the capabilities it lists.
- [14]
This instance of CLEANGULP uses a single hardcoded command-and-control domain, thecovnresation[.]com, which appears to be a typosquat impersonating The Conversation (theconversation[.]com), a non-profit network of media organizations.
- [15]
All network traffic observed by Volexity used HTTP as its communication method.
- [16]
After initialization the malware performs an initial beacon to register with the C2: a POST to /beacon/pre-register with the user agent string Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36.
- [17]
The body of the request and response are AES-256-GCM encrypted then Base64 encoded using a custom alphabet, and the AES key used is the SHA256 of the custom alphabet string: cbeeb7dd5e89261cde032825fd10bb80bad2e3fbf5b91fdc9137ad463ffa8f21.
- [18]
The registration UUID value does not conform to RFC 9562; it is a time-based session identifier.
- [19]
UTA0565's exploitation on September 3-4, 2026 preceded Volexity's first public report on the chain, published September 9, 2026, by five to six days.
Sources
3 independent publishers whose own reporting we read for this story.
- cyberscoop.comVolexity spots another China-aligned threat group exploiting Chrome and Microsoft defects
1 article · September 22, 2026
- thehackernews.comChinese Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy CLEANGULP Malware
1 article · September 23, 2026
- Mind the (Patch) Gap, Part 2: Fake Websites Used to Deploy Chrome & Windows 0-Day Exploits
volexity.com
1 article · September 21, 2026
Topics and entities
Entities
- Center for American Progress
- CVE-2026-85046
- The Conversation
- China Digital Times
- Google Chrome
- Microsoft Windows
- CVE-2026-85880
- Volexity
- Proofpoint
- Censys
- CVE-2026-87491