UTA0565 Used Chrome and Windows Zero-Days to Deploy CLEANGULP: IOCs and Hunting Guide

By AiCybr Editorial · Published September 23, 2026

Volexity has identified a third China-linked threat actor, UTA0565, using the same three-vulnerability Google Chrome and Windows exploit chain that appeared in early-September espionage campaigns. The newly documented UTA0565 activity ran on September 3–4, 2026, while the vulnerabilities were still unpatched, and delivered a previously undocumented Windows malware family that Volexity calls CLEANGULP.

The chain combined CVE-2026-85046 and CVE-2026-87491 in Chrome with CVE-2026-85880 in Windows. UTA0565 paired it with phishing messages and spoofed websites impersonating legitimate media and policy organizations. Volexity's September 21 report adds the actor, delivery infrastructure, CLEANGULP payload and a concrete IOC set to the earlier investigation of the exploit kit.

For defenders who already patched the three vulnerabilities, the useful new work is retrospective: search endpoints, DNS/proxy records and EDR telemetry from the early-September exposure window for CLEANGULP and UTA0565 artifacts.

What UTA0565 changed in the campaign

Volexity observed phishing directed at Asian government entities and another campaign impersonating the Center for American Progress. Links led to attacker-controlled domains that closely resembled legitimate sites:

The fake Center for American Progress site loaded legitimate content while adding a hidden config.html iframe. That iframe contained the same core exploit components Volexity had documented in its September 9 investigation.

The UTA0565 variant changed the final delivery stage. It downloaded chrome_cleanup.exe in-process, removed Mark of the Web and launched the payload through the Windows shell using COM. Volexity found the core exploit logic, version checks and stage sequencing largely unchanged from the earlier campaigns.

That distinction matters for incident response: detections built only around the earlier GRIMWEDGE or LONGTALE payloads can miss a host compromised through the same exploit kit by UTA0565.

CLEANGULP indicators to hunt

Volexity identifies the delivered Win64 executable as follows:

The installed path and scheduled-task name are especially useful host-hunting pivots. A process launched from %LOCALAPPDATA%\Microsoft\IME\MicrosoftIME.exe alongside a MicrosoftIME scheduled task deserves immediate investigation.

Volexity assesses with high confidence that the malware supports shell-command execution, process listing, file upload and download, and execution of Beacon Object Files. Its observed command-and-control traffic used HTTP. Request and response bodies were encrypted with AES-256-GCM and then encoded with a custom Base64 alphabet.

Network and infrastructure pivots

The observed CLEANGULP sample communicated with thecovnresation[.]com, a typosquat of theconversation.com. Volexity also identified additional domains it assesses with medium confidence as related to UTA0565 activity:

• personclouds[.]com
• outsourcingwise[.]net
• halal-navi[.]net
• halaltak[.]net
• thecovnresation[.]net
• borneobulletins[.]top

These medium-confidence pivots are appropriate for historical DNS, proxy and network-telemetry searches. Treat a match as an investigation lead and correlate it with endpoint activity, timestamps and the higher-confidence CLEANGULP artifacts.

For the confirmed C2, Volexity observed an initial HTTP POST to /beacon/pre-register with Content-Type: application/octet-stream. That combination gives defenders another network-level pivot where full packet or proxy telemetry is retained.

Patch status and exposure window

The UTA0565 attacks occurred on September 3–4, before fixes for the exploited chain had reached affected users. Volexity's earlier analysis describes the chain as:

1. CVE-2026-85046 — Chrome V8 type confusion providing the initial arbitrary read/write capability.
2. CVE-2026-87491 — a separate Chrome/WebAssembly defect used to escape the V8 sandbox.
3. CVE-2026-85880 — a Windows kernel privilege-escalation flaw used to escape Chrome's sandboxed renderer and reach the browser process.

Organizations should run current supported Chrome/Chromium builds and apply Microsoft's security update for CVE-2026-85880. Systems that were exposed during the September 3–4 window merit retrospective hunting even when they are fully patched today, because patching closes the vulnerability but does not remove persistence from a previously compromised endpoint.

Practical hunting sequence

Start with the highest-confidence host artifacts: search EDR and filesystem telemetry for the CLEANGULP SHA-256, %LOCALAPPDATA%\Microsoft\IME\MicrosoftIME.exe, and creation or execution of a scheduled task named MicrosoftIME. Correlate hits with chrome_cleanup.exe, browser activity and process creation around the suspected compromise time.

Next, search DNS, proxy, firewall and packet records for thecovnresation[.]com, the two confirmed phishing domains and the medium-confidence infrastructure pivots. Where HTTP metadata is available, look for /beacon/pre-register requests associated with suspicious endpoints.

Finally, review email and browser telemetry for visits to the spoofed domains during September 3–4. A user reaching one of the confirmed lure sites from Chrome on Windows during the unpatched window should be treated as a high-priority investigation even when the endpoint no longer contains the obvious persistence artifacts.

Volexity has published its campaign indicators in its public threat-intelligence repository, allowing defenders to import or translate the IOC set into their own SIEM, EDR and network-hunting workflows.

Why this update matters

The September 21 disclosure expands the known use of the exploit kit beyond the two actor clusters documented earlier in the month. Volexity says the core chain appeared across multiple China-linked operators while the delivered malware and infrastructure differed. Proofpoint has separately identified additional users of the kit, which supports prioritizing exploit-chain telemetry alongside payload-specific signatures.

For defenders, the operational takeaway is straightforward: current patching addresses the vulnerable components, while the new CLEANGULP and UTA0565 indicators improve retrospective detection for systems that may have encountered the chain before those fixes were available.

Sources

• Volexity — Mind the (Patch) Gap, Part 2: https://www.volexity.com/blog/2026/09/21/mind-the-patch-gap-part-2-fake-websites-used-to-deploy-chrome-windows-0-day-exploits/
• Volexity — Part 1 technical analysis of the Chrome/Windows exploit chain: https://www.volexity.com/blog/2026/09/09/mind-the-patch-gap-multiple-chinese-threat-actors-chain-0-day-exploits-in-chrome-windows/
• Volexity public IOC repository — September 21 Chrome Part 2: https://github.com/volexity/threat-intel/tree/main/2026/2026-09-21%20Chrome-part-2
• Microsoft Security Response Center — CVE-2026-85880: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85880
• The Hacker News — independent coverage of UTA0565 and CLEANGULP: https://thehackernews.com/2026/09/chinese-hackers-exploit-chrome-windows.html