# UTA0565 Chains Chrome and Windows Zero-Days (CVE-2026-85046, CVE-2026-87491, CVE-2026-85880) to Deploy CLEANGULP Malware

> Volexity reports that China-aligned threat group UTA0565 chained two Chrome zero-days with a Windows ALPC privilege-escalation zero-day to compromise targets between September 3-4, 2026, before any of the three CVEs were patched or disclosed, deploying a previously undocumented malware family, CLEANGULP, via phishing emails and spoofed media/NGO websites.

- **Published:** 2026-09-27T00:00:00Z
- **Last reviewed:** 2026-09-27T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2681
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-uta0565-cleangulp-exploit-chain-tl-2026-2681.webp?v=b08bff46 (Threadlinqs threat intel: CVE-2026-85046 UTA0565 Zero-Days: Detection & IOCs (TL-2026-2681) — Critical severity, 17 IOCs, 9 detection rules.)
- **ID:** TL-2026-2681
- **Severity:** CRITICAL (CVSS 8.8)
- **Category:** ZERO_DAY
- **Status:** ACTIVE
- **Actor:** UTA0565 (China)
- **Detections:** 9 (1 shown free below) · **IOCs:** 17 (3 shown free below)
- **CVEs:** CVE-2026-85046, CVE-2026-87491, CVE-2026-85880

## Description

Between September 3 and 4, 2026, the China-aligned threat group UTA0565 chained two unpatched Google Chrome zero-days (CVE-2026-85046, a V8 type-confusion bug providing arbitrary read/write inside the browser sandbox, and CVE-2026-87491, a V8 out-of-bounds write enabling sandbox escape) with a Windows Advanced Local Procedure Call kernel privilege-escalation zero-day (CVE-2026-85880, rooted in the RtlpCreateServerAcl code path) to fully compromise victim hosts before any of the three vulnerabilities were publicly disclosed or patched.

UTA0565 delivered the chain via phishing emails that linked to a network of spoofed websites impersonating legitimate media and policy organizations, including chinadigitaltimes[.]top (spoofing chinadigitaltimes.net) and americanprgoress[.]top (a typosquat of americanprogress.org), registered between September 2 and 4, 2026 and hosted behind 96.9.125[.]52. Victims who visited a fake site triggered a hidden iframe (config.html) that ran the same web-worker-based, three-stage position-independent exploit chain (host reconnaissance, kernel-mode privilege escalation, browser-process injection) that Volexity had already documented on September 9, 2026 as shared by two other Chinese threat actors, UTA0560 and JungleBamboo (APT31/Violet Typhoon/TA412), against the identical three CVEs. Volexity assesses that the byte-identical shellcode across unrelated operators points to a common exploit developer supplying multiple China-nexus groups during the Chrome/Windows patch gap.

Following successful exploitation, UTA0565 dropped a previously undocumented malware family, CLEANGULP, delivered as chrome_cleanup.exe and installed to %LOCALAPPDATA%\Microsoft\IME\MicrosoftIME.exe, persisting via a scheduled task named "MicrosoftIME." CLEANGULP is a control-flow-flattened, indirect-call-obfuscated backdoor supporting shell command execution, process listing, file upload/download, and Beacon Object File (BOF) execution. It communicates over HTTP POST to /beacon/pre-register on the typosquatted C2 domain thecovnresation[.]com (spoofing theconversation.com), encrypting traffic with AES-256-GCM using a key derived from the SHA-256 hash of a custom Base64 alphabet embedded in the binary.

Google patched CVE-2026-85046 on September 4, 2026 (Chrome 152.0.7977.82/.83) and CVE-2026-87491 on September 8, 2026 (Chrome 153.0.8010.36/.37); Microsoft patched CVE-2026-85880 on September 8, 2026 as part of its September Patch Tuesday. CISA added all three CVEs to its Known Exploited Vulnerabilities catalog. Volexity published its UTA0565-specific findings, including the CLEANGULP attribution, on September 21, 2026.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1566 Phishing
- T1203 Exploitation for Client Execution
- T1059 Command and Scripting Interpreter
- T1055 Process Injection
- T1053 Scheduled Task/Job
- T1036 Masquerading
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1057 Process Discovery
- T1082 System Information Discovery
- T1005 Data from Local System
- T1071 Application Layer Protocol
- T1573 Encrypted Channel

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**SPL — CLEANGULP Persistence via 'MicrosoftIME' Scheduled Task and Masqueraded Payload** (`TL-2026-2681-SPL-002`)

Detects creation of the 'MicrosoftIME' scheduled task and/or the CLEANGULP payload (chrome_cleanup.exe dropped to / masquerading as %LOCALAPPDATA%\Microsoft\IME\MicrosoftIME.exe) used by UTA0565 for persistence and defense evasion after chaining the ALPC privilege-escalation zero-day (CVE-2026-85880). CLEANGULP also supports process listing and system reconnaissance (T1057/T1082) once installed.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1053.005, T1036.005, T1027, T1057, T1082
- **Data sources:** sysmon, windows_security, microsoft_defender_for_endpoint
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
(index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode IN (1,11)
 (Image="*\\Microsoft\\IME\\MicrosoftIME.exe" OR TargetFilename="*\\Microsoft\\IME\\MicrosoftIME.exe" OR OriginalFileName="chrome_cleanup.exe" OR Hashes="*8858ea412dc306b3558885af18006c5ca24689e8875733b5e13b3c2692e603cb*" OR Hashes="*177652713dad3c128bd9195abf2b7603*"))
OR
(index=wineventlog sourcetype="WinEventLog:Security" EventCode=4698 TaskName="*MicrosoftIME*")
| eval detection_reason="CLEANGULP persistence via scheduled task 'MicrosoftIME' and/or payload dropped/masquerading at %LOCALAPPDATA%\\Microsoft\\IME\\MicrosoftIME.exe"
| table _time, ComputerName, User, EventCode, Image, TargetFilename, TaskName, CommandLine, Hashes
| sort -_time
```

### Microsoft KQL

```kql
union isfuzzy=true
(DeviceFileEvents
| where Timestamp > ago(24h)
| where FolderPath has @"Microsoft\IME\MicrosoftIME.exe" or FileName =~ "chrome_cleanup.exe"
   or SHA256 == "8858ea412dc306b3558885af18006c5ca24689e8875733b5e13b3c2692e603cb"
   or MD5 == "177652713dad3c128bd9195abf2b7603"
| project Timestamp, DeviceName, InitiatingProcessAccountName, FolderPath, FileName, SHA256, MD5),
(DeviceProcessEvents
| where Timestamp > ago(24h)
| where ProcessCommandLine has "MicrosoftIME" and ProcessCommandLine has_any ("schtasks", "Register-ScheduledTask")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine)
| order by Timestamp desc
```

### Sigma

```yaml
title: CLEANGULP Persistence via 'MicrosoftIME' Scheduled Task and Masqueraded Payload
id: 4a8d6c19-2f77-4e0a-9c5b-1e6f7a3d8b02
status: experimental
description: Detects creation of the 'MicrosoftIME' scheduled task and/or the CLEANGULP payload (chrome_cleanup.exe / MicrosoftIME.exe) dropped at %LOCALAPPDATA%\Microsoft\IME\, as used by UTA0565 for persistence and masquerading following exploitation of the CVE-2026-85046/CVE-2026-87491/CVE-2026-85880 chain.
references:
    - https://www.volexity.com/blog/2026/09/21/mind-the-patch-gap-part-2-fake-websites-used-to-deploy-chrome-windows-0-day-exploits/
author: Threadlinqs Team
date: 2026/09/27
tags:
    - attack.persistence
    - attack.t1053.005
    - attack.defense-evasion
    - attack.t1036.005
    - attack.t1027
    - attack.discovery
    - attack.t1057
    - attack.t1082
    - malware.cleangulp
logsource:
    category: process_creation
    product: windows
detection:
    selection_task:
        EventID: 4698
        TaskName|contains: 'MicrosoftIME'
    selection_file:
        - TargetFilename|endswith: '\Microsoft\IME\MicrosoftIME.exe'
        - OriginalFileName: 'chrome_cleanup.exe'
        - Hashes|contains:
            - '8858EA412DC306B3558885AF18006C5CA24689E8875733B5E13B3C2692E603CB'
            - '177652713DAD3C128BD9195ABF2B7603'
    condition: 1 of selection_*
falsepositives:
    - None expected — 'MicrosoftIME' is not a legitimate Microsoft-signed scheduled task name and this path/hash combination is unique to this campaign
level: critical
```

**Known false positives:**

- Legitimate Microsoft IME language-pack installers writing to %LOCALAPPDATA%\Microsoft\IME\ — verify file hash and scheduled-task action against known-good IME binaries
- Third-party IME software using a similarly named scheduled task

**Tuning notes:** Refresh hash IOCs on each detection cycle since CLEANGULP is trivially rebuildable with a new file hash; treat the scheduled-task name 'MicrosoftIME' and install path as the higher-confidence, longer-lived indicator and pivot on TaskName plus install path even when the file hash has rotated.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- KQL — Chrome/Edge Spawning Command Interpreter (Browser Exploit Chain / Sandbox Escape) (locked: unlock with TL Creds)
- KQL — CLEANGULP Persistence via 'MicrosoftIME' Scheduled Task and Masqueraded Payload (locked: unlock with TL Creds)
- KQL — CLEANGULP AES-256-GCM C2 Beacon to Typosquatted Domain (/beacon/pre-register) (locked: unlock with TL Creds)
- Sigma — Chrome/Edge Renderer Spawning Command Interpreter (Browser Exploit Chain) (locked: unlock with TL Creds)
- Sigma — CLEANGULP Persistence via 'MicrosoftIME' Scheduled Task and Masqueraded Payload (locked: unlock with TL Creds)
- Sigma — CLEANGULP AES-256-GCM C2 Beacon to Typosquatted Domain (/beacon/pre-register) (locked: unlock with TL Creds)
- SPL — Chrome/Edge Spawning Command Interpreter (Browser Exploit Chain / Sandbox Escape) (locked: unlock with TL Creds)
- SPL — CLEANGULP AES-256-GCM C2 Beacon to Typosquatted Domain (/beacon/pre-register) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 17)

Defanged, TLP:CLEAR.

- IP address: `96.9.125[.]52`
- Domain: `americanprgoress[.]top`
- File hash: `8858ea412dc306b3558885af18006c5ca24689e8875733b5e13b3c2692e603cb`

Full set of 17 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Mind the (Patch) Gap, Part 2: Fake Websites Used to Deploy Chrome & Windows 0-Day Exploits](https://www.volexity.com/blog/2026/09/21/mind-the-patch-gap-part-2-fake-websites-used-to-deploy-chrome-windows-0-day-exploits/)
- [Mind the (Patch) Gap: Multiple Chinese Threat Actors Chain 0-day Exploits in Chrome & Windows](https://www.volexity.com/blog/2026/09/09/mind-the-patch-gap-multiple-chinese-threat-actors-chain-0-day-exploits-in-chrome-windows/)
- [Volexity spots another China-aligned threat group exploiting Chrome and Microsoft defects](https://cyberscoop.com/volexity-uta0565-china-exploit-chain-chrome-microsoft/)
- [Chinese Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy CLEANGULP Malware](https://thehackernews.com/2026/09/chinese-hackers-exploit-chrome-windows.html)
- [CISA KEV Catalog Entry: CVE-2026-85046 (Google Chromium V8 Type Confusion Vulnerability)](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-85046)
- [CISA KEV Catalog Entry: CVE-2026-87491 (Google Chromium V8 Out of Bounds Write Vulnerability)](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-87491)
- [CISA KEV Catalog Entry: CVE-2026-85880 (Microsoft Windows Heap-Based Buffer Overflow Vulnerability)](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-85880)
- [Stable Channel Update for Desktop (Chrome 153.0.8010.36/.37, fixes CVE-2026-87491)](https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html)
- [MSRC Vulnerability Guide: CVE-2026-85880 (Windows ALPC Elevation of Privilege)](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85880)
- [Google warns of new Chrome zero-day flaw exploited in attacks](https://www.bleepingcomputer.com/news/security/google-warns-of-new-chrome-zero-day-flaw-exploited-in-attacks/)
- [Google fixes yet another actively exploited Chrome zero-day (CVE-2026-87491)](https://www.helpnetsecurity.com/2026/09/09/google-chrome-cve-2026-87491-zero-day-flaw/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2681