7 mincritical
Mind the (Patch) Gap, Part 2: Fake Websites Used to Deploy Chrome & Windows 0-Day Exploits
UTA0565, a Chinese APT, chains Chrome and Windows 0-day exploits via fake websites to deploy CLEANGULP malware targeting Asian government and NGO entities. The exploit kit uses CVE-2026-85046 and CVE-2026-87491 for Chrome RCE combined with CVE-2026-85880 for Windows privilege escalation. CLEANGULP installs to %LOCALAPPDATA%\Microsoft\IME\MicrosoftIME.exe, persists via scheduled task 'MicrosoftIME', and beacons over HTTP to C2 using AES-256-GCM encrypted communications. Multiple spoofed domains impersonate media outlets and NGOs to reduce victim suspicion.
Sens:■ Immediate
IOCs20
9domain3cve2filename1file path1ip1md51sha1
Detection / Hunteropenrouter
Immediate Actions
defender takeaway
- Block thecovnresation.com and americanprgoress.top at network perimeter
- Hunt for scheduled task 'MicrosoftIME' across all endpoints
- Search for chrome_cleanup.exe and MicrosoftIME.exe in %LOCALAPPDATA%
- Patch Google Chrome and Microsoft Windows to latest versions immediately
Key Takeaways
- Exploit kit shared across multiple Chinese threat actors indicating coordinated development effort.
- CLEANGULP supports shell, process listing, file upload/download, and beacon object file execution.
- Phishing lures used pro-democracy Hong Kong activist theme and Center for American Progress impersonation.
- C2 communication uses custom Base64 alphabet with SHA256-derived AES-256-GCM key for encryption.
- Seven additional spoofed domains identified targeting media, halal restaurant, and corporate training sectors.
Attack Chain
- Initial Access: Phishing emails with links to spoofed domains impersonating media outlets and NGOs
- Exploitation: Spoofed sites load hidden iframe triggering Chrome RCE exploits CVE-2026-85046 and CVE-2026-87491
- Privilege Escalation: Windows LPE exploit CVE-2026-85880 elevates privileges on target system
- Delivery: Exploit chain downloads chrome_cleanup.exe via COM shell execution after MOTW removal
- Persistence: CLEANGULP installs to %LOCALAPPDATA%\Microsoft\IME\MicrosoftIME.exe and creates scheduled task 'MicrosoftIME'
- C2: CLEANGULP beacons over HTTP to thecovnresation.com using AES-256-GCM encrypted communications
Affected Systems
- Google Chrome (unpatched versions prior to September 2026)
- Microsoft Windows (unpatched versions prior to September 2026)
- Asian government entity employees
- NGO and civil society workers
- Media organization audiences and readers
Vulnerabilities (CVEs)
| CVE | Product | Severity | Description |
|---|---|---|---|
| CVE-2026-85046 | Google Chrome | Chrome zero-day exploit used in chained RCE attack via fake websites. | |
| CVE-2026-87491 | Google Chrome | Second Chrome zero-day exploit in the chained exploitation chain. | |
| CVE-2026-85880 | Microsoft Windows | Windows local privilege escalation exploit chained with Chrome RCE. |
Detection Availability
No detection rules or queries are published in the source article.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | High | Process creation, file writes, scheduled task creation, and HTTP C2 connections are observable by EDR. |
| Network Visibility | Medium | C2 uses HTTP with AES-256-GCM encryption; domain and beacon path visible but payload content encrypted. |
| Detection Difficulty | Moderate | Known IOCs enable detection but obfuscation and legitimate-appearing domains increase analysis complexity. |
Hunting Hypotheses
| Hypothesis | Telemetry | Stage | FP Risk |
|---|---|---|---|
| Browser process spawning chrome_cleanup.exe or writing to %LOCALAPPDATA%\Microsoft\IME\ (T1189) | Process creation and file write events | Execution | Low — atypical path for browser-spawned processes |
| Scheduled task creation named 'MicrosoftIME' executing from non-system directories (T1053.005) | Scheduled task creation logs | Persistence | Low — task name mimics legitimate IME but path differs |
| HTTP POST to /beacon/pre-register with octet-stream content and custom User-Agent (T1071.001) | HTTP proxy and DNS logs | Command and Control | Medium — custom User-Agent may overlap legitimate Chrome traffic |
| Processes removing Mark-of-the-Web from downloaded files followed by COM execution (T1553.005) | Process execution and file attribute change logs | Execution | Low — MOTW removal from browser downloads is unusual |
Required Log Sources
- Process creation logs (Sysmon Event ID 1)
- Network connection logs (Sysmon Event ID 3)
- Scheduled task creation logs
- File creation logs (Sysmon Event ID 11)
- DNS resolution logs
- HTTP proxy logs
Key Behavioral Indicators
- chrome_cleanup.exe downloaded by browser process chain
- MicrosoftIME.exe in %LOCALAPPDATA%\Microsoft\IME\ path
- Scheduled task named 'MicrosoftIME' from non-system path
- HTTP POST to /beacon/pre-register with octet-stream content
- COM object launching executable after browser process exit
- Hidden iframe loading config.html on spoofed websites
Control Gaps
- Signature-based AV may miss obfuscated CLEANGULP binary
- Network DLP cannot inspect AES-256-GCM encrypted C2 traffic
- Web filtering may not block newly registered typosquatted domains
- MOTW removal bypasses browser-based download safety warnings
False Positive Assessment
Low — CLEANGULP uses specific installation paths, C2 domains, and scheduled task names unlikely to appear in legitimate software.
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Block all identified spoofed domains at DNS and proxy layers
- Enable HTTP inspection for C2 beacon patterns at /beacon/pre-register
- Deploy network rules flagging POST requests to /beacon/pre-register paths
- Monitor for typosquatted domain registrations matching known organizational brands
User Protection
- Deploy Chrome and Windows security patches to all endpoints
- Block executable downloads from untrusted or newly registered domains
- Alert on Mark-of-the-Web removal followed by COM-based execution
- Enable EDR blocking for processes writing to %LOCALAPPDATA%\Microsoft\IME\
Security Awareness
- Warn users about phishing emails impersonating media organizations and NGOs
- Instruct users to verify URLs for typosquatting before clicking links
- Remind staff that pro-democracy themed emails are active lures
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping17 techniques
Tactic
Resource Development
Tactic
Initial Access
Tactic
Execution
Tactic
Privilege Escalation
Tactic
Stealth
Tactic
Defense Impairment
Tactic
Discovery
Tactic
Command and Control
Tactic
Exfiltration
Plain-Language Summary
A Chinese hacking group called UTA0565 created fake websites mimicking real news outlets and organizations to trick victims into visiting them. When victims opened these sites, hidden code exploited security flaws in Google Chrome and Microsoft Windows to install a new type of malware called CLEANGULP. The malware lets attackers run commands, steal files, and maintain persistent access to infected computers. Organizations in Asian government and civil society should check for indicators of compromise and patch affected software immediately.
Additional IOCs
- Domains:
personclouds[.]com- Attacker-controlled domain registered 2026-09-03 for campaignsoutsourcingwise[.]net- Spoofed domain impersonating outsourcingwise.comhalal-navi[.]net- Spoofed domain impersonating halal-navi.com halal restaurant sitehalaltak[.]net- Spoofed domain impersonating halalketak.net
- File Hashes:
177652713dad3c128bd9195abf2b7603(MD5) - MD5 hash of CLEANGULP payload chrome_cleanup.exe668aa5551315ab26b67118fbb29f8e4560a1e1af(SHA1) - SHA1 hash of CLEANGULP payload chrome_cleanup.exe
- File Paths:
%LOCALAPPDATA%\Microsoft\IME\MicrosoftIME.exe- CLEANGULP installation path masquerading as Microsoft IME
- Command Lines:
- Purpose: Launch chrome_cleanup.exe via Windows shell using COM after removing Mark of the Web | Tools:
COM,Windows Shell| Stage: Execution - Purpose: Create scheduled task named MicrosoftIME for CLEANGULP persistence | Tools:
Windows Task Scheduler| Stage: Persistence
- Purpose: Launch chrome_cleanup.exe via Windows shell using COM after removing Mark of the Web | Tools:
- Other:
[email protected]- Phishing sender email for Asian government pro-democracy lure[email protected]- Phishing sender email for Center for American Progress impersonationMicrosoftIME- Scheduled task name used for CLEANGULP persistence
Showing defanged values
- cveCVE-2026-85046Chrome zero-day exploit used in chained RCE attack via fake websites.
- cveCVE-2026-85880Windows local privilege escalation exploit chained with Chrome RCE.
- cveCVE-2026-87491Second Chrome zero-day exploit in the chained exploitation chain.
- domainamericanprgoress[.]topSpoofed site hosting exploit kit and final payload delivery
- domainborneobulletins[.]topSpoofed Borneo Bulletin domain used in targeting campaigns
- domainchinadigitaltimes[.]topSpoofed China Digital Times domain serving exploit kit
- domainhalal-navi[.]netSpoofed domain impersonating halal-navi.com halal restaurant site
- domainhalaltak[.]netSpoofed domain impersonating halalketak.net
- domainoutsourcingwise[.]netSpoofed domain impersonating outsourcingwise.com
- domainpersonclouds[.]comAttacker-controlled domain registered 2026-09-03 for campaigns
- domainthecovnresation[.]comCLEANGULP C2 domain typosquatting theconversation.com
- domainthecovnresation[.]netAdditional C2 or spoofed domain associated with UTA0565
- filenamechrome_cleanup.exeCLEANGULP payload filename downloaded by exploit kit
- filenameMicrosoftIME.exeCLEANGULP installed filename masquerading as Microsoft IME
- file_path%LOCALAPPDATA%\Microsoft\IME\MicrosoftIME.exeCLEANGULP installation path masquerading as Microsoft IME
- ip96[.]9[.]125[.]52Hosted fake China Digital Times website serving exploits
- md5177652713dad3c128bd9195abf2b7603MD5 hash of CLEANGULP payload chrome_cleanup.exe
- sha1668aa5551315ab26b67118fbb29f8e4560a1e1afSHA1 hash of CLEANGULP payload chrome_cleanup.exe
- sha2568858ea412dc306b3558885af18006c5ca24689e8875733b5e13b3c2692e603cbCLEANGULP payload (chrome_cleanup.exe) downloaded by exploit chain
- urlhxxps://americanprgoress[.]top/chrome_cleanup[.]exeURL serving CLEANGULP final payload from exploit chain
