A recent spear-phishing campaign has been linked to a Chinese threat actor, identified as UTA0560, which exploits recently patched vulnerabilities in Google Chrome and Microsoft Windows. This campaign, which targeted various non-governmental organizations (NGOs) on September 1, 2026, deploys a malicious JavaScript backdoor known as GRIMWEDGE.
Details of the Attack
According to researchers from Volexity, the spear-phishing emails were crafted to entice recipients into clicking a link that redirected them to a U.S.-based university’s website. This site was vulnerable to a reflected cross-site scripting (XSS) flaw, allowing the attackers to redirect users to their own infrastructure, where a multi-stage exploit chain was hosted.
The exploit chain, previously detailed by Proofpoint, leverages three distinct vulnerabilities—two in Chrome and one in Windows Advanced Local Procedure Call (ALPC). The sequence begins with CVE-2026-85046, which enables arbitrary read/write access within the V8 sandbox. It then escapes the browser sandbox using CVE-2026-87491 before employing CVE-2026-85880 to inject code into the Chrome browser process, achieving arbitrary code execution.
Utilizing this method, UTA0560 successfully deploys GRIMWEDGE, which is designed for host reconnaissance, file and process management, command execution, and payload delivery. The initial spear-phishing email persuades the recipient to click an embedded link that leads to a legitimate but vulnerable website.
The threat actor capitalized on this vulnerability to trigger a zero-day exploit chain, dubbed BlueMoon, to deliver the malware. Notably, the attack filtered out systems not running Chrome on Windows, ensuring that only targeted environments were compromised. The final exploit page contained three binary payloads encoded as Base64 strings within JavaScript:
- p1: Shellcode that reflectively loads a DLL for host reconnaissance and fingerprinting.
- p2: Shellcode that reflectively loads a DLL to facilitate Windows kernel privilege escalation.
- pp: Shellcode for browser process injection and payload download.
In this case, the next-stage payload is an executable named “msgbox.exe,” which acts as a loader that extracts a legitimate Windows binary and a malicious DLL, “wsc.dll.” This DLL initiates a sideloading chain and subsequently contacts the same server to retrieve a text file named after the device’s hostname obtained during the profiling phase.
This text file is an MSI installer that executes an obfuscated JavaScript backdoor embedded within its custom actions. Once activated, GRIMWEDGE enters a persistent command loop, polling a command-and-control (C2) server (“ocr.opusaccel[.]top”) for further instructions, which are executed in memory using the eval() command. The backdoor is capable of parsing several commands, including:
- Info: Conduct system reconnaissance.
- Dir: Retrieve a directory listing.
- Mkdir: Create a directory.
- Del: Delete a file.
- Tasklist: Enumerate running processes.
- Taskkill: Terminate a process by PID.
- Type: Read a file up to 5 MB.
- Run: Execute a command within a hidden window.
- Upload (chunk): Retrieve a Base64-encoded chunk from the C2 server and append it to an in-memory buffer.
- Upload (commit): Save the accumulated buffer to disk as the final file.
Researchers noted that the code lacks built-in persistence, lateral movement, or exfiltration mechanisms beyond the file-read and upload commands. However, it provides UTA0560 with a foothold on compromised hosts, allowing for reconnaissance and the deployment of additional tools via the Run and Upload commands.
In a related observation, Volexity identified another China-linked threat actor, known as JungleBamboo (or APT31), employing the same exploit chain around the same time to deploy a loader named SUPERSTOMP. This loader installs LONGTALE, a credential-stealing Chrome extension masquerading as a legitimate Google Gemini extension. LONGTALE offers extensive information-theft capabilities, including keylogging, cookie theft, and remote command execution.
The simultaneous use of the same exploit chain by multiple Chinese threat actors raises questions about the potential sharing or sale of the exploit by its developer, possibly after reverse-engineering changes in the Chromium source code. Notably, the patch gap presents a significant risk, as vulnerabilities were addressed in the open-source Chromium codebase but had not yet been incorporated into a stable release of Google Chrome, effectively rendering them zero-days against Chrome.
Volexity emphasized that such patch-gap vulnerabilities create an extended window for threat actors to execute exploitation campaigns, particularly as advancements in language models enhance rapid vulnerability research and exploit development.
