UTA0565 Chains Chrome and Windows Zero-Days (CVE-2026-85046, CVE-2026-87491, CVE-2026-85880) to Deploy CLEANGULP Malware

Key facts

Detection coverage

As of 2026-09-27, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2681 across Splunk SPL, Microsoft KQL and Sigma, covering 17 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: SPL — CLEANGULP Persistence via 'MicrosoftIME' Scheduled Task and Masqueraded Payload

Detects creation of the 'MicrosoftIME' scheduled task and/or the CLEANGULP payload (chrome_cleanup.exe dropped to / masquerading as %LOCALAPPDATA%\Microsoft\IME\MicrosoftIME.exe) used by UTA0565 for persistence and defense evasion after chaining the ALPC privilege-escalation zero-day (CVE-2026-85880). CLEANGULP also supports process listing and system reconnaissance (T1057/T1082) once installed.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1053.005, T1036.005, T1027, T1057, T1082
• Data sources: sysmon, windows_security, microsoft_defender_for_endpoint
• Severity: critical
• Confidence: high

Splunk SPL

(index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode IN (1,11)
 (Image="*\\Microsoft\\IME\\MicrosoftIME.exe" OR TargetFilename="*\\Microsoft\\IME\\MicrosoftIME.exe" OR OriginalFileName="chrome_cleanup.exe" OR Hashes="*8858ea412dc306b3558885af18006c5ca24689e8875733b5e13b3c2692e603cb*" OR Hashes="*177652713dad3c128bd9195abf2b7603*"))
OR
(index=wineventlog sourcetype="WinEventLog:Security" EventCode=4698 TaskName="*MicrosoftIME*")
| eval detection_reason="CLEANGULP persistence via scheduled task 'MicrosoftIME' and/or payload dropped/masquerading at %LOCALAPPDATA%\\Microsoft\\IME\\MicrosoftIME.exe"
| table _time, ComputerName, User, EventCode, Image, TargetFilename, TaskName, CommandLine, Hashes
| sort -_time

Microsoft KQL

union isfuzzy=true
(DeviceFileEvents
| where Timestamp > ago(24h)
| where FolderPath has @"Microsoft\IME\MicrosoftIME.exe" or FileName =~ "chrome_cleanup.exe"
   or SHA256 == "8858ea412dc306b3558885af18006c5ca24689e8875733b5e13b3c2692e603cb"
   or MD5 == "177652713dad3c128bd9195abf2b7603"
| project Timestamp, DeviceName, InitiatingProcessAccountName, FolderPath, FileName, SHA256, MD5),
(DeviceProcessEvents
| where Timestamp > ago(24h)
| where ProcessCommandLine has "MicrosoftIME" and ProcessCommandLine has_any ("schtasks", "Register-ScheduledTask")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine)
| order by Timestamp desc

Sigma

title: CLEANGULP Persistence via 'MicrosoftIME' Scheduled Task and Masqueraded Payload
id: 4a8d6c19-2f77-4e0a-9c5b-1e6f7a3d8b02
status: experimental
description: Detects creation of the 'MicrosoftIME' scheduled task and/or the CLEANGULP payload (chrome_cleanup.exe / MicrosoftIME.exe) dropped at %LOCALAPPDATA%\Microsoft\IME\, as used by UTA0565 for persistence and masquerading following exploitation of the CVE-2026-85046/CVE-2026-87491/CVE-2026-85880 chain.
references:
    - https://www.volexity.com/blog/2026/09/21/mind-the-patch-gap-part-2-fake-websites-used-to-deploy-chrome-windows-0-day-exploits/
author: Threadlinqs Team
date: 2026/09/27
tags:
    - attack.persistence
    - attack.t1053.005
    - attack.defense-evasion
    - attack.t1036.005
    - attack.t1027
    - attack.discovery
    - attack.t1057
    - attack.t1082
    - malware.cleangulp
logsource:
    category: process_creation
    product: windows
detection:
    selection_task:
        EventID: 4698
        TaskName|contains: 'MicrosoftIME'
    selection_file:
        - TargetFilename|endswith: '\Microsoft\IME\MicrosoftIME.exe'
        - OriginalFileName: 'chrome_cleanup.exe'
        - Hashes|contains:
            - '8858EA412DC306B3558885AF18006C5CA24689E8875733B5E13B3C2692E603CB'
            - '177652713DAD3C128BD9195ABF2B7603'
    condition: 1 of selection_*
falsepositives:
    - None expected — 'MicrosoftIME' is not a legitimate Microsoft-signed scheduled task name and this path/hash combination is unique to this campaign
level: critical

Known false positives:

• Legitimate Microsoft IME language-pack installers writing to %LOCALAPPDATA%\Microsoft\IME\ — verify file hash and scheduled-task action against known-good IME binaries
• Third-party IME software using a similarly named scheduled task

Tuning notes: Refresh hash IOCs on each detection cycle since CLEANGULP is trivially rebuildable with a new file hash; treat the scheduled-task name 'MicrosoftIME' and install path as the higher-confidence, longer-lived indicator and pivot on TaskName plus install path even when the file hash has rotated.

• 🔒 KQL — Chrome/Edge Spawning Command Interpreter (Browser Exploit Chain / Sandbox Escape) · unlock with TL Creds
• 🔒 KQL — CLEANGULP Persistence via 'MicrosoftIME' Scheduled Task and Masqueraded Payload · unlock with TL Creds
• 🔒 KQL — CLEANGULP AES-256-GCM C2 Beacon to Typosquatted Domain (/beacon/pre-register) · unlock with TL Creds
• 🔒 Sigma — Chrome/Edge Renderer Spawning Command Interpreter (Browser Exploit Chain) · unlock with TL Creds
• 🔒 Sigma — CLEANGULP Persistence via 'MicrosoftIME' Scheduled Task and Masqueraded Payload · unlock with TL Creds
• 🔒 Sigma — CLEANGULP AES-256-GCM C2 Beacon to Typosquatted Domain (/beacon/pre-register) · unlock with TL Creds
• 🔒 SPL — Chrome/Edge Spawning Command Interpreter (Browser Exploit Chain / Sandbox Escape) · unlock with TL Creds
• 🔒 SPL — CLEANGULP AES-256-GCM C2 Beacon to Typosquatted Domain (/beacon/pre-register) · unlock with TL Creds

Indicators of compromise

As of 2026-09-27, Threadlinqs Intelligence tracks 17 indicators of compromise for TL-2026-2681.

Sample indicators (3 of 17)

• IP address: 96.9.125[.]52
• Domain: americanprgoress[.]top
• File hash: 8858ea412dc306b3558885af18006c5ca24689e8875733b5e13b3c2692e603cb

Defanged, TLP:CLEAR. Full set of 17 indicators: unlock with TL Creds.

Technical analysis

Between September 3 and 4, 2026, the China-aligned threat group UTA0565 chained two unpatched Google Chrome zero-days (CVE-2026-85046, a V8 type-confusion bug providing arbitrary read/write inside the browser sandbox, and CVE-2026-87491, a V8 out-of-bounds write enabling sandbox escape) with a Windows Advanced Local Procedure Call kernel privilege-escalation zero-day (CVE-2026-85880, rooted in the RtlpCreateServerAcl code path) to fully compromise victim hosts before any of the three vulnerabilities were publicly disclosed or patched.

UTA0565 delivered the chain via phishing emails that linked to a network of spoofed websites impersonating legitimate media and policy organizations, including chinadigitaltimes[.]top (spoofing chinadigitaltimes.net) and americanprgoress[.]top (a typosquat of americanprogress.org), registered between September 2 and 4, 2026 and hosted behind 96.9.125[.]52. Victims who visited a fake site triggered a hidden iframe (config.html) that ran the same web-worker-based, three-stage position-independent exploit chain (host reconnaissance, kernel-mode privilege escalation, browser-process injection) that Volexity had already documented on September 9, 2026 as shared by two other Chinese threat actors, UTA0560 and JungleBamboo (APT31/Violet Typhoon/TA412), against the identical three CVEs. Volexity assesses that the byte-identical shellcode across unrelated operators points to a common exploit developer supplying multiple China-nexus groups during the Chrome/Windows patch gap.

Following successful exploitation, UTA0565 dropped a previously undocumented malware family, CLEANGULP, delivered as chrome_cleanup.exe and installed to %LOCALAPPDATA%\Microsoft\IME\MicrosoftIME.exe, persisting via a scheduled task named "MicrosoftIME." CLEANGULP is a control-flow-flattened, indirect-call-obfuscated backdoor supporting shell command execution, process listing, file upload/download, and Beacon Object File (BOF) execution. It communicates over HTTP POST to /beacon/pre-register on the typosquatted C2 domain thecovnresation[.]com (spoofing theconversation.com), encrypting traffic with AES-256-GCM using a key derived from the SHA-256 hash of a custom Base64 alphabet embedded in the binary.

Google patched CVE-2026-85046 on September 4, 2026 (Chrome 152.0.7977.82/.83) and CVE-2026-87491 on September 8, 2026 (Chrome 153.0.8010.36/.37); Microsoft patched CVE-2026-85880 on September 8, 2026 as part of its September Patch Tuesday. CISA added all three CVEs to its Known Exploited Vulnerabilities catalog. Volexity published its UTA0565-specific findings, including the CLEANGULP attribution, on September 21, 2026.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information

Persistence

T1053 Scheduled Task/Job

Privilege Escalation

T1055 Process Injection

Discovery

T1057 Process Discovery; T1082 System Information Discovery

Execution

T1059 Command and Scripting Interpreter; T1203 Exploitation for Client Execution

Command and Control

T1071 Application Layer Protocol; T1573 Encrypted Channel

Initial Access

T1566 Phishing

Resource Development

T1583 Acquire Infrastructure

Remediation

Patches

• Google Chrome 152.0.7977.82/.83 (fixes CVE-2026-85046)
• Google Chrome 153.0.8010.36/.37 (fixes CVE-2026-87491)
• Microsoft September 2026 Patch Tuesday cumulative update (fixes CVE-2026-85880)

Immediate actions

• Patch Chrome to >=153.0.8010.36/.37 and apply the September 2026 Windows cumulative update to all endpoints immediately
• Block/sinkhole the identified UTA0565 domains (chinadigitaltimes.top, americanprgoress.top, thecovnresation.com, thecovnresation.net, personclouds.com, halal-navi.net, borneobulletins.top) and 96.9.125.52 at the perimeter and DNS resolver
• Hunt for the 'MicrosoftIME' scheduled task and %LOCALAPPDATA%\Microsoft\IME\MicrosoftIME.exe on Windows endpoints
• Hunt for outbound HTTP POST traffic to /beacon/pre-register, especially against typosquatted news/media domains

Workarounds

• Restrict or closely monitor execution from %LOCALAPPDATA%\Microsoft\IME\ pending patch deployment
• Apply CISA BOD 26-04 mitigations per the KEV catalog entries for all three CVEs

Longer-term hardening

• Deploy EDR with behavioral detection for BOF/shellcode execution and process injection into browser processes
• Stand up typosquat/DNS-lookalike monitoring for organizations frequently impersonated in these campaigns (media outlets, policy NGOs, government agencies)
• Reduce patch-gap exposure by tracking upstream Chromium security fixes and staged rollouts ahead of general stable-channel availability

Affected and fixed versions

• Google — Chrome
  Vulnerable versions: < 152.0.7977.82 (CVE-2026-85046)
  Fixed in: 152.0.7977.82; 152.0.7977.83
• Google — Chrome
  Vulnerable versions: < 153.0.8010.36 (CVE-2026-87491)
  Fixed in: 153.0.8010.36; 153.0.8010.37
• Microsoft — Windows
  Vulnerable versions: Windows 10 1607; Windows 10 1809; Windows 10 21H2; Windows 10 22H2; Windows Server 2012; Windows Server 2012 R2; Windows Server 2016; Windows Server 2019; Windows Server 2022
  Fixed in: September 2026 cumulative update (CVE-2026-85880)

Timeline

• 2026-08-04 CVE-2026-85046 (V8 type confusion) is privately reported to the Chromium project, entering the Chromium public source tree ahead of a stable Chrome release and opening the 'patch gap' window the exploit chain would abuse.
• 2026-08-06 Independent researcher Jihyeon Jeong reports the V8 out-of-bounds write later designated CVE-2026-87491 to Google, earning a $2,500 bug bounty; this bug forms the sandbox-escape stage of the same exploit chain.
• 2026-09-02 UTA0565 begins registering the spoofed lure domains used in the campaign, including locked-ioc-6, locked-ioc-7, locked-ioc-8/.net, locked-ioc-12, locked-ioc-13, and locked-ioc-10.
• 2026-09-03 Volexity observes UTA0565 exploiting the still-unpatched Chrome and Windows zero-day chain via spoofed media/NGO websites to deploy the CLEANGULP backdoor against targets.
• 2026-09-04 Google ships Chrome 152.0.7977.82/.83, fixing CVE-2026-85046; CISA adds the CVE to its Known Exploited Vulnerabilities catalog the same day with an September 18 remediation deadline.
• 2026-09-08 Google ships Chrome 153.0.8010.36/.37, fixing CVE-2026-87491.
• 2026-09-08 Microsoft's September 2026 Patch Tuesday fixes CVE-2026-85880 (Windows ALPC heap-based buffer overflow); CISA adds it to KEV with a September 22 remediation deadline for federal agencies.
• 2026-09-09 Volexity publishes 'Mind the (Patch) Gap,' documenting two other Chinese threat actors, UTA0560 and JungleBamboo (APT31/Violet Typhoon/TA412), independently abusing the identical three-CVE exploit chain; CISA adds CVE-2026-87491 to KEV.
• 2026-09-21 Volexity publishes 'Mind the (Patch) Gap, Part 2,' attributing the September 3-4 spoofed-website campaign to a third actor, UTA0565, and naming the previously undocumented CLEANGULP malware family.
• 2026-09-22 CyberScoop and other outlets report on Volexity's UTA0565/CLEANGULP findings.

Sources cited

• CISA KEV Catalog Entry: CVE-2026-85046 (Google Chromium V8 Type Confusion Vulnerability) CISA · Government advisory · 2026-09-04
• CISA KEV Catalog Entry: CVE-2026-87491 (Google Chromium V8 Out of Bounds Write Vulnerability) CISA · Government advisory · 2026-09-09
• CISA KEV Catalog Entry: CVE-2026-85880 (Microsoft Windows Heap-Based Buffer Overflow Vulnerability) CISA · Government advisory · 2026-09-08
• Mind the (Patch) Gap, Part 2: Fake Websites Used to Deploy Chrome & Windows 0-Day Exploits volexity.com · Vendor report · 2026-09-21
• Mind the (Patch) Gap: Multiple Chinese Threat Actors Chain 0-day Exploits in Chrome & Windows volexity.com · Vendor report · 2026-09-09
• Stable Channel Update for Desktop (Chrome 153.0.8010.36/.37, fixes CVE-2026-87491) chromereleases.googleblog.com · Vendor report · 2026-09-08
• MSRC Vulnerability Guide: CVE-2026-85880 (Windows ALPC Elevation of Privilege) Microsoft Security Response Center · Vendor report · 2026-09-08
• Volexity spots another China-aligned threat group exploiting Chrome and Microsoft defects cyberscoop.com · News · 2026-09-22
• Chinese Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy CLEANGULP Malware The Hacker News · News · 2026-09-22
• Google warns of new Chrome zero-day flaw exploited in attacks BleepingComputer · News · 2026-09-04
• Google fixes yet another actively exploited Chrome zero-day (CVE-2026-87491) Help Net Security · News · 2026-09-09

More in zero day

• Autonomous AI Agent Sandbox Escape via JFrog Artifactory Zero-Days and Hugging Face Dataset Pipeline Intrusion (OpenAI ExploitGym Incident)
• Citrix NetScaler ADC/Gateway Zero-Day CVE-2026-88779 ("PitScaler 2") Exploited Against Appliances Patched Days Earlier (CISA KEV)
• Vercel Confirms KVM Zero-Day Guest-to-Host VM Escape (Root on Host) via Sandbox Bug Bounty; $50,000 Bounty Awarded
• Fortinet FortiMail critical path traversal flaw CVE-2026-104286 (FG-IR-26-175) exploited in zero-day attacks
• Kiteworks Urges Customers to Shut Down Systems After Federal Threat Intelligence Warning of Possible Zero-Day Attack

Related coverage of this activity

• BlueMoon exploit kit

More from UTA0565

• September 2026 Major Cyber Attacks: ShinyHunters FBIJobs/PeopleSoft (CVE-2026-35273), Clop Leak Site Grav CMS Hijack (CVE-2026-42608), PaperCut AI-Agent Campaign, BlueMoon Zero-Day Chain, NetScaler C2 (CVE-2026-88771)

Other reports on CVE-2026-85046

• NCSC CTO Weekly Summary (week ending 2026-09-13): actively exploited Cisco FMC (CVE-2026-20079/20316), PaperCut NG/MF (CVE-2026-81578/82078), MikroTik RouterOS and FortiGate (CVE-2025-25249) flaws; NetScaler SAML bypass (CVE-2026-19490); BlueMoon exploit kit
• Google Patches Chrome Zero-Day CVE-2026-85046 (6th of 2026), Actively Exploited V8 Type Confusion

Previous and next in zero day

• Kiteworks Urges Customers to Take Systems Offline Amid Suspected Zero-Day Threat Previous report