A China-Linked Crew Fired a Chrome and Windows Zero-Day Chain Before Anyone Could Patch. Our Index Held the Payload Hash for Four Days With No Name On It.
A China-linked crew Volexity tracks as UTA0565 spent September 3 and 4 hitting Asian government targets with a Chrome and Windows exploit chain that nobody could patch yet, because nobody but them knew it existed. Volexity's Damien Cash and Tom Lancaster published the full write-up on September 21 and named the payload CLEANGULP.
We had one of their indicators in our index a day later. We did not know it was theirs. That is the part of this post that is about us, and it comes after the part that is about you.
What happened
The chain is three bugs: two in Chrome's V8 engine (CVE-2026-85046 and CVE-2026-87491) to get code running in the renderer, and one in Windows (CVE-2026-85880) to break out of the sandbox. CISA confirmed all three as exploited and added them to the Known Exploited Vulnerabilities catalog on September 4, 8 and 9. If your browsers and Windows machines took their September updates and actually restarted, this chain is closed on them.
The delivery is the interesting part. UTA0565 sent Chinese- and English-language phishing email to government entities in Asia, including a lure urging support for the imprisoned Hong Kong activist Chow Hang-tung. The links went to look-alike sites: a copy of China Digital Times at chinadigitaltimes[.]top, a typosquat of the Center for American Progress at americanprgoress[.]top, and further spoofs of The Conversation and the Borneo Bulletin. The fake page loaded a hidden iframe, the iframe fired the exploits, and the final shellcode downloaded a file called chrome_cleanup.exe.
That file is CLEANGULP. It copies itself to %LOCALAPPDATA%\Microsoft\IME\MicrosoftIME.exe, persists through a scheduled task named MicrosoftIME, and calls home to thecovnresation[.]com, a typosquat of The Conversation, at the path /beacon/pre-register.
The bigger finding is that UTA0565 is not the only one using the chain. Volexity documented another operator with the same exploits in its Part 1 report on September 9, and says Proofpoint has identified several other users of the kit. CyberScoop, reporting on Proofpoint's work, gives the shared framework the name BlueMoon and counts at least four espionage users, most with a suspected China nexus. The Hacker News separately reports a China-linked operator delivering a payload called GRIMWEDGE through the same chain. We have not pulled that primary report yet, so treat the GRIMWEDGE link as reported, not verified by us. Volexity's own read is that the kit was shared, customized and weaponized across multiple groups.
What a cash-poor defender does about it
Three things, none of which cost money.
Confirm the restart, not the download. A Chrome update that has downloaded but not relaunched does not protect the browser, and a Windows cumulative update waiting on a reboot does not protect the sandbox. Check the running version, not the update status.
Hunt the persistence, because it is cheap to find. A scheduled task named MicrosoftIME, or an executable at %LOCALAPPDATA%\Microsoft\IME\MicrosoftIME.exe, is not something Windows puts there. One query across your endpoints answers it.
Block the infrastructure. Every domain below is attacker-registered. None of them is a compromised legitimate site, so blocking them costs you nothing but the attacker's traffic.
The indicators
All from Volexity's report and its GitHub indicator repository, defanged here. We did not observe any of these ourselves.
Command and control: thecovnresation[.]com
Exploit delivery (spoofed media sites): americanprgoress[.]top, chinadigitaltimes[.]top, thecovnresation[.]net, borneobulletins[.]top
Suspected UTA0565 domains, which Volexity itself labels "suspected": personclouds[.]com, outsourcingwise[.]net, halal-navi[.]net, halaltak[.]net
Payload URL: hxxps://americanprgoress[.]top/chrome_cleanup[.]exe
CLEANGULP payload hashes: SHA256 8858ea412dc306b3558885af18006c5ca24689e8875733b5e13b3c2692e603cb, SHA1 668aa5551315ab26b67118fbb29f8e4560a1e1af, MD5 177652713dad3c128bd9195abf2b7603
Hosting IP that served the fake China Digital Times site, per Volexity's Censys search: 96.9.125[.]52. The site was offline by the time Volexity looked, and hosting addresses get reassigned. We scored it 70. That is below the 80 our own edge shield blocks at, but it is in the default CSVs, so your min_confidence setting decides whether you block it.
Phishing senders: marcellulgulgowsdtu62@gmail[.]com and jung_yeheeu@outlook[.]com. These are worth a mail-gateway search. Our feed has no type for sender addresses, so they are here and not in the CSVs.
The rest of this week's exploited list
CISA added thirteen entries to KEV between September 18 and 25. These are the ones for software a small shop is likely to run, in the order we would patch them. Every CVE ID and date below was checked against CISA's catalog, version 2026.09.25.
Priority | Product | CVE | KEV added | What it is |
1 | Chrome and Windows | Sep 4, 9, 8 | The CLEANGULP chain above. Everyone runs it. | |
2 | F5 BIG-IP APM | Sep 22 | Heap overflow, unauthenticated remote code execution when an access policy and an OAuth profile are configured on a virtual server. CISA says to apply F5's mitigation iRule, triage, then patch. | |
3 | Check Point Security Management Server, Multi-Domain, Log Server, SmartEvent | Sep 22 | Path traversal that lets an unauthenticated attacker upload and run scripts on the management plane. Fix in Check Point sk1000171. | |
4 | Check Point Security Gateway and Spark with site-to-site or remote-access VPN | Sep 22 | Certificate-validation flaw, unauthenticated code execution on the gateway. Fix in sk1000117. | |
5 | WSO2 API Manager, API Control Plane, Traffic Manager, Universal Gateway | Sep 24 | Path traversal into unrestricted file upload and remote code execution. | |
6 | Adobe Commerce and Magento | Sep 24 | Incorrect authorization, elevated access with no user interaction. Adobe APSB26-92. | |
7 | WordPress Core | Sep 25 | Remote file inclusion to code execution through page-template resolution, unauthenticated. | |
8 | SharePoint Server | Sep 25 | Code injection by an authorized user over the network. | |
9 | MikroTik RouterOS | Sep 25 | Unauthenticated session channel and exec request, chainable to full compromise. |
On Check Point: the gateway VPN bug is one Check Point found internally and shipped fixes for on its own schedule, and when we wrote about it on September 11 the company said there was no evidence of exploitation, while the Dutch NCSC called exploitation imminent. CISA has now confirmed it is being exploited. That is the vendor-found, vendor-fixed, patch-before-it-gets-hit sequence working as designed. The only way to lose is to not apply the patch. The management-server bug, CVE-2026-93616, is new to us this week and is the more urgent of the two, because the management server is the box that programs every gateway it manages.
Two items from the week are not in KEV as of catalog 2026.09.25, so we cannot list them with verified IDs: the Roundcube pre-authentication SQL injection that the press reports as exploited in the wild, and Kiteworks' advice to customers to shut servers down while it investigates a possible zero-day. If you run either one exposed to the internet, act on the vendor's advisory now rather than waiting for the catalog.
What we held, and what we did not
Stated flat, with both timestamps.
We held the CLEANGULP SHA256. Our vendor-blog watcher, which reads researchers' posts on a schedule and pulls out indicators, ingested it on September 22 at 19:48 UTC. Volexity published its indicator repository on September 21 at 20:49 UTC. That is 23 hours behind the vendor. It is an import of their work, not a detection of ours, and it went in with no malware family and no actor, so for four days a search for CLEANGULP or UTA0565 against our feed would have found nothing, even though the hash was sitting right there.
We did not hold any of the domains, the C2, the payload URL, or the hosting IP until this post.
As of this post, all fourteen are in the feed under source manual-batch-cleangulp, attributed to UTA0565 and CLEANGULP. The five confirmed attacker domains, the payload URL and the three hashes are at confidence 90. The four domains Volexity marks as suspected are at 75, and the hosting IP is at 70. All fourteen are in the default CSVs we serve. The 75s and the 70 sit below the 80 our own edge shield blocks at, and your min_confidence setting decides whether you block them.
We did not check our own edge honeypot for probing of F5, Check Point or Roundcube paths in this pass. That is an open question, not a zero.
On the Check Point gateway bug we have a dated post from September 11, eleven days before CISA confirmed exploitation. That is coverage of a vendor disclosure, not early detection, and we are not calling it a lead.
One more thing about that hash. The watcher that caught it runs at 17 and 47 minutes past the hour. This week we found that a blocking task inside our own analytics server had been silently eating every scheduled job that fell on a minute divisible by five, for three days. The watcher survived because of the minute it was scheduled on. That is luck, not design. The fix shipped the same day: the scheduler now replays a tick it missed during a stall, and a sweeper catches up any job whose slot was lost.
Was this useful? Rate this post. The widget is at the bottom of the page, and we read every response.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.
Was this useful? Thirty seconds, no cookies, no tracking, no third parties, your address hashed and never stored. If the box below does not load, the same question lives at https://analytics.dugganusa.com/nps.html?post=a-china-linked-crew-fired-a-chrome-and-windows-zero-day-chain-before-anyone-could-patch-our-index-h
Comments