Volexity Reports UTA0565 Exploited Chrome and Windows Zero-Days
Summary
Volexity says China-aligned group UTA0565 used a three-vulnerability zero-day chain in phishing campaigns targeting Asian government entities and other organizations, deploying a previously undocumented malware family called CLEANGULP.
Key points
- Volexity said UTA0565 exploited vulnerabilities in Chromium-based browsers and Windows before they were disclosed or patched.
- The reported vulnerabilities are CVE-2026-85046 and CVE-2026-87491 in the Chromium JavaScript engine, and CVE-2026-85880 in Windows Advanced Local Procedure Call.
- Phishing emails and fake websites targeted Asian government entities; some messages urged support for imprisoned Hong Kong activist Chow Hang-tung.
- Other phishing emails used domains impersonating the Center for American Progress and China Digital Times.
- UTA0565 deployed CLEANGULP, a malware family Volexity had not previously documented.
- Volexity found exploit-kit components also observed in activity linked to multiple Chinese threat groups, and said the full scope and impact may be broader than currently observed.
Article Details
- Event Type
- Zero-day exploitation and phishing campaign
- Impact
- UTA0565 exploited a three-vulnerability chain affecting Chromium-based browsers and Windows before the vulnerabilities were disclosed or patched. The campaigns targeted Asian government entities and other organizations; Volexity said the full scope and impact may be broader than the activity observed so far.
MITRE ATT&CK
T1068 · Exploitation for Privilege EscalationThe attack chain included a Windows privilege-escalation zero-day.T1203 · Exploitation for Client ExecutionThe group exploited remote-code-execution vulnerabilities in Chromium-based browsers.T1566 · PhishingUTA0565 sent phishing emails using deceptive lures and spoofed domains.
CVE
People
Threat Actors
APT31Proofpoint previously attributed attacks involving the zero-days to this threat group.UNK_DoubleCheckProofpoint previously attributed attacks involving the zero-days to this tracked group.UNK_LateNightProofpoint previously attributed attacks involving the zero-days to this tracked group.UNK_QuietRacketProofpoint previously attributed attacks involving the zero-days to this tracked group.UTA0565Volexity tracks this China-aligned threat group, which exploited the zero-day chain and conducted phishing campaigns.
Malware
Vendors
Products
Chromium-based browsersCVE-2026-85046 and CVE-2026-87491, remote-code execution defects in the JavaScript engine for Chromium-based browsers; and CVE-2026-85880, a privilege-escalation zero-day that Microsoft disclosed Sept.Google ChromeVolexity found the Chinese threat group UTA0565 exploiting a chain of zero-day vulnerabilities in Chrome and Microsoft products across multiple phishing campaigns.Microsoft WindowsThe attacks targeted Chrome-based browsers and Microsoft Windows systems.
Countries
Industries
GovernmentThe group used fake websites, spoofed domains, and a previously undocumented malware family called CLEANGULP to target Asian government entities and other organizations.Media“CLEANGULP.” Researchers also found several domains likely used by UTA0565 in similar campaigns targeting media organizations, halal restaurant search websites and corporate training organizations.