China-linked threat actors UTA0560 and JungleBamboo chained a Google Chrome zero-day with a Windows kernel privilege-escalation flaw in phishing campaigns targeting NGOs and other victims.
Volexity documented the operations, detected on September 1, 2026, as using identical browser-to-kernel exploit components but ultimately installing separate espionage payloads: the GRIMWEDGE JScript backdoor and the LONGTALE credential-stealing Chrome extension.
The intrusion began with spear-phishing emails containing links to legitimate U.S. university websites vulnerable to reflected cross-site scripting.
China-Linked Hackers Chain Chrome Zero-Day
The actors abused those sites as redirectors, sending targets to attacker-controlled landing pages. Victims saw a convincing donation-form image while a concealed iframe launched the malicious exploit chain.
At its center was CVE-2026-85046, a V8 JavaScript engine type-confusion issue. Although a fix had entered Chromium’s open-source code after private reporting in August, Chrome had not yet shipped it.
Volexity characterized this as a “patch gap”: effectively a zero-day for Chrome users despite becoming an N-day in the upstream source tree.
The exploit first achieved arbitrary read/write within the V8 sandbox through CVE-2026-85046, then used CVE-2026-87491, a WebAssembly defect, to escape that sandbox.
A third flaw, CVE-2026-85880 in the Windows kernel component RtlpCreateServerAcl, elevated privileges and broke out of Chrome’s sandboxed renderer. The final shellcode injected into Chrome’s browser process and downloaded a payload chosen through an exeurl parameter.
The exploit was engineered for reliability and stealth. It ran in a Web Worker, preserving the visible browser tab if an exploit attempt crashed, and retried recoverable failures up to five times.
Its reconnaissance stage collected Windows version, token privileges, CPU details, and hypervisor indicators before selectively triggering the kernel exploit against targeted Windows builds.
UTA0560 used financial-themed NGO lures and delivered GRIMWEDGE through a loader chain. A dropper extracted a legitimate executable and sideloaded a DLL, established a five-minute scheduled task called “Windows Scheduled System,” and retrieved an MSI payload.
The MSI executed an in-memory JScript backdoor able to survey hosts, list and manipulate files, enumerate or kill processes, execute commands, and upload files.
JungleBamboo, also tracked as APT31, Violet Typhoon, and TA412, used distinct infrastructure yet hosted byte-for-byte identical exploitation shellcode.
Its SUPERSTOMP loader tampered with Chrome Secure Preferences to install LONGTALE, which masqueraded as a Google Gemini extension. LONGTALE captures keystrokes, form data, cookies, session storage, screenshots, browsing information, and supports remote collection commands.
Volexity assessed with medium confidence that a shared exploit developer provided or sold the chain to separate Chinese operators, likely capitalizing on Chrome’s release delay.
The case underscores how upstream patch disclosures can give well-resourced adversaries a short but operationally valuable exploitation window.
Defenders should update Chrome and Windows immediately, investigate phishing redirects and unexpected browser process behavior, and hunt for suspicious scheduled tasks, extension changes, and outbound connections to listed infrastructure.
Indicators of Compromise
| Indicator | Type | Actor | Description / SHA256 |
|---|---|---|---|
cloud.shinewrist[.]net | Domain | UTA0560 | Exploit-hosting and command-and-control infrastructure |
ocr[.]opusaccel[.]top | Domain | UTA0560 | GRIMWEDGE JScript backdoor C2 endpoint |
206[.]166[.]251[.]164 | IP address | UTA0560 | Host associated with cloud.shinewrist[.]net |
gitprogram[.]com | Domain | JungleBamboo | Phishing, exploit delivery, and C2 infrastructure |
hxxps://proof.gitprogram[.]com/a4/j8 | URL | JungleBamboo | September 2 phishing URL serving the shared Chrome exploit chain |
69c1603f3f9015beb0097d0a3bb0f17400c314e2eae65a7eceacd3b93ea570dc | SHA-256 | UTA0560 | msgbox.exe GRIMWEDGE loader, a Win32 executable |
5eb5645511b00e4f4d73125654eeb3a3930fcf09c65685dc7f03f725331492e3 | SHA-256 | JungleBamboo | a001 LONGTALE malicious Chrome extension |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.
