Zero-Day Triple Play: How Chinese APT UTA0565 Chained Chrome V8 and Windows ALPC Flaws to Deploy CLEANGULP Malware
Date: September 23, 2026
Author: Threat Research & Intelligence Team, Digital Spying
Category: Advanced Persistent Threats (APT) / Zero-Day Exploit Chains / Malware Reverse Engineering
Tags: UTA0565, CLEANGULP, Chrome Zero-Day, Windows ALPC, Volexity, BlueMoon, CISA KEV, Cyber Espionage
Executive Summary
In a masterclass of nation-state offensive cyber tradecraft, a China-aligned advanced persistent threat (APT) actor tracked as UTA0565 has been observed chaining two zero-day vulnerabilities in Google Chrome with a local privilege escalation zero-day in Microsoft Windows to compromise government and diplomatic targets across Asia. Disclosed in an exhaustive threat intelligence report published on September 21–23, 2026, by Volexity and reported by The Hacker News, the campaign weaponized the vulnerabilities during the critical "patch-gap" window before enterprise administrators could deploy vendor security updates.
The intrusion chain represents a full, zero-click-to-system assault:
1. CVE-2026-85046: A memory corruption vulnerability in the Chrome V8 JavaScript rendering engine.
2. CVE-2026-87491: A sandbox escape vulnerability breaking out of Chrome's isolated renderer process.
3. CVE-2026-85880: A heap-based buffer overflow in the Windows Advanced Local Procedure Call (ALPC) subsystem allowing immediate escalation from standard user privileges to NT AUTHORITY\SYSTEM.
Victims were lured to a network of meticulously cloned watering-hole websites masquerading as legitimate regional media outlets, policy think tanks, and non-governmental organizations (NGOs). Upon infection, the exploit dropped CLEANGULP, a previously undocumented, heavily obfuscated C-based backdoor supporting interactive shell access, file transfers, and Beacon Object File (BOF) execution. CLEANGULP establishes persistence via a scheduled task masquerading as the legitimate Microsoft Input Method Editor (MicrosoftIME.exe).
This campaign demonstrates how shared, state-backed exploit frameworks—specifically iterations of the BlueMoon exploit kit—are being syndicated across multiple distinct Chinese threat clusters to target high-value geopolitical targets at machine speed.
Technical Deep-Dive: Anatomy of the 3-Stage Exploit Chain
The exploit chain developed by UTA0565 bridges the gap between remote web browsing and full operating system compromise.t
+-----------------------------------------------------------------------------------+
| UTA0565 ZERO-DAY EXPLOIT CHAIN TO SYSTEM |
|---|+-----------------------------------------------------------------------------------+
Victim Browser (Google Chrome) Watering Hole Server Target Windows Host
| | |
| 1. Lured to cloned media/think-tank site | |
|-------------------------------------------->| |
| | 2. Delivers profiling JS |
| |<---------------------------------|
| | |
| [STAGE 1: V8 RCE - CVE-2026-85046] | |
| - Triggers V8 JIT type confusion | |
| - Gains arbitrary read/write in renderer | |
| | |
| [STAGE 2: SANDBOX ESCAPE - CVE-2026-87491] | |
| - Exploits Mojo IPC broker channel | |
| - Escapes Chrome browser sandbox | |
| - Spawns unprivileged shell in User Space | |
|------------------------------------------------------------------------------->|
| |
| | [STAGE 3: KERNEL LPE - CVE-2026-85880]
| | - ALPC Heap buffer overflow
| | - Overwrites token privileges
| | - Elevates to NT AUTHORITY\SYSTEM
| |
| | [PAYLOAD STAGING & EXECUTION]
| | - Drops %LOCALAPPDATA%\Microsoft\ | | IME\MicrosoftIME.exe [CLEANGULP]
| | - Creates Scheduled Task: "MicrosoftIME"
| |
| | 4. Outbound HTTPS C2 Beacon
| |----------------------------------------> C2 Infrastructure
v v
1. The Lure & Fingerprinting Phase
UTA0565 deployed a network of dozens of domain names mimicking legitimate Asian media outlets, regional business portals, and foreign policy institutes. When a target visited the site:
* A lightweight JavaScript profiler executed client-side checks evaluating the browser User-Agent, WebGL vendor strings, screen dimensions, and hardware concurrency.
* If the visitor was identified as a target operating a vulnerable Chrome release on 64-bit Windows, the server served the customized exploit payload. Non-target visitors were served benign news content.
2. The Browser Exploitation (Chrome V8 RCE + Sandbox Escape)
* CVE-2026-85046 (V8 Renderer RCE): The initial stage exploits a type-confusion flaw within Chrome's V8 Just-In-Time (JIT) compiler. By creating an array with dynamic property transitions, the exploit tricks the optimization engine into miscalculating object offsets, granting the attacker arbitrary memory read and write primitives within the isolated renderer process.
* CVE-2026-87491 (V8 Sandbox Escape): Chrome isolates web rendering within a restricted low-integrity sandbox. To break free, the shellcode exploits an IPC communication flaw between the sandboxed renderer and the privileged browser broker process via the Mojo IPC interface. The exploit abuses message deserialization to launch an unprivileged Windows executable outside the browser boundary.
3. Privilege Escalation (Windows ALPC CVE-2026-85880)
To achieve full administrative dominance, the exploit chain immediately triggers CVE-2026-85880:
* The exploit targets the Windows Advanced Local Procedure Call (ALPC) subsystem—the high-speed inter-process communication mechanism used across the Windows operating system.
* A heap-based buffer overflow in the ALPC message validation handler allows a local process to overwrite adjacent kernel structures.
* The exploit modifies the current process’s security token, elevating its privilege level from standard user to `NT AUTHORITY\SYSTEM`.
Reverse Engineering the CLEANGULP Implant
Once SYSTEM privileges are attained, the chain drops and installs CLEANGULP, a stealthy, custom backdoor engineered specifically for long-term cyber espionage.
1. Evasion & Control-Flow Obfuscation
Volexity’s reverse-engineering analysis revealed that CLEANGULP was developed in C and compiled using Microsoft Visual C++:
* Control-Flow Flattening: The binary breaks functional blocks into fragmented switch-case statements governed by a state variable loop, completely obscuring the original code logic and defeating static decompilers like IDA Pro and Ghidra.
* Dynamic API Resolution: Rather than importing system functions via the Import Address Table (IAT), CLEANGULP resolves all Windows API addresses dynamically at runtime using custom hash algorithms (e.g., `MurmurHash`).
2. Persistence via Microsoft IME Masquerading
To blend into standard Windows system behavior, CLEANGULP drops itself to:
`%LOCALAPPDATA%\Microsoft\IME\MicrosoftIME.exe`
It achieves persistence by creating a Windows Scheduled Task named "MicrosoftIME", configured to execute with highest privileges upon user logon.
3. Operational Command Capabilities
CLEANGULP establishes an encrypted HTTPS beacon to command-and-control (C2) domains utilizing a custom, non-standard session UUID:
| Command Identifier | Functional Description |
| :--- | :--- |
| `shell` | Spawns an interactive, hidden command prompt (`cmd.exe` / `powershell.exe`). |
| `ps` | Enumerates active running processes, architectures, and parent PIDs. |
| `upload` | Transfers files from the C2 server directly to the victim’s local disk. |
| `download` | Exfiltrates confidential local files, documents, and archives to the C2. |
| `bof_exec` | Executes in-memory Beacon Object Files (BOFs), enabling modular post-exploitation (e.g., Mimikatz credential dumping) without touching disk. |
Threat Actor Profile & Attribution: The Syndicated Arsenal
Volexity attributes this campaign to UTA0565, an advanced espionage cluster operating in support of Chinese state intelligence objectives:
1. Shared Exploit Frameworks (The BlueMoon Connection): The technical architecture of the Chrome-Windows chain used by UTA0565 matches artifacts observed in campaigns by other prominent Chinese state groups (including Volt Typhoon and Bronze Silhouette). This confirms that a centralized military or intelligence research bureau is engineering high-tier zero-days and distributing them across multiple operational units.
2. Patch-Gap Exploitation: The attacks were executed between September 3 and September 4, 2026—the precise window between Google's upstream Chromium commit and Microsoft's Patch Tuesday release. Threat actors actively monitor open-source Chromium repositories to reverse-engineer bug fixes and weaponize them before enterprise automated patching cycles complete.
Strategic Recommendations & Hardening Blueprint
1. Apply Critical Updates Across Chrome and Windows
* Google Chrome: Verify that all corporate endpoints have updated to Google Chrome version 154.0.x or higher, which remediates both V8 vulnerabilities.
* Microsoft Windows: Apply Microsoft’s September 2026 Cumulative Security Update, which resolves the ALPC privilege escalation flaw (CVE-2026-85880).
2. Harden Browser Isolation via Group Policy (GPO)
Deploy enterprise browser security baselines to mitigate zero-day browser breakouts:
* Enable Chrome Renderer AppContainer: Ensure AppContainer sandboxing is enforced.
* Strict Site Isolation: Enforce `--site-per-process` across all browser instances to prevent cross-origin memory leaks.
3. Threat Hunting & Detection Playbook
Security Operations Centers (SOCs) should immediately run the following hunting queries:
* Scheduled Task Audit: Query enterprise fleet telemetry for any scheduled task named `MicrosoftIME` that does not originate from `C:\Windows\System32\IME\`.
* Path Execution Telemetry: Alert on any executable launched from `%LOCALAPPDATA%\Microsoft\IME\`.
* DNS Beacon Hunting: Review perimeter firewall and proxy logs for outbound HTTPS connections to spoofed media domains identified in Volexity’s intelligence telemetry.
*For technical threat intelligence advisories, exploit chain breakdowns, and nation-state threat hunting playbooks, follow Digital Spying.*