hacker-news · Crawled Sep 15, 2026
China-Linked Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy GRIMWEDGE
4 IoCs 1 Actors 1 CVEs
Read original article ↗
AI Summary
A Chinese threat actor tracked as UTA0560 conducted a spear-phishing campaign targeting NGOs by exploiting a zero-day chain in Google Chrome and Microsoft Windows. The attack abused CVE-2026-85046, CVE-2026-87491, and CVE-2026-85880 to bypass sandbox protections and execute arbitrary code, ultimately deploying a JavaScript-based backdoor named GRIMWEDGE. This backdoor enables host reconnaissance, command execution, file operations, and payload delivery through a C2 server. A second China-linked group, JungleBamboo (APT31), used the same exploit chain to deploy the SUPERSTOMP loader and the LONGTALE credential-stealing Chrome extension.
AI-extracted · verify before operational use
Extracted Entities 2 found
Indicators of Compromise 4 extracted
MITRE ATT&CK TTPs 43 techniques
T1003 OS Credential Dumping · Credential Access T1003.001 LSASS Memory · Credential Access T1018 Remote System Discovery · Discovery T1021.001 Remote Desktop Protocol · Lateral Movement T1027 Obfuscated Files or Information · Defense Evasion T1053.005 Scheduled Task · Execution T1055 Process Injection · Defense Evasion T1055.001 Dynamic-link Library Injection · Defense Evasion T1055.012 Process Hollowing · Defense Evasion T1059 Command and Scripting Interpreter · Execution T1059.001 PowerShell · Execution T1059.003 Windows Command Shell · Execution T1068 Exploitation for Privilege Escalation · Privilege Escalation T1071.001 Web Protocols · Command And Control T1071.003 Mail Protocols · Command And Control T1078 Valid Accounts · Defense Evasion T1082 System Information Discovery · Discovery T1083 File and Directory Discovery · Discovery T1085 T1085 T1087.002 Domain Account · Discovery T1105 Ingress Tool Transfer · Command And Control T1133 External Remote Services · Persistence T1134 Access Token Manipulation · Defense Evasion T1134.001 Token Impersonation/Theft · Defense Evasion T1190 Exploit Public-Facing Application · Initial Access T1203 Exploitation for Client Execution · Execution T1204 User Execution · Execution T1204.002 Malicious File · Execution T1210 Exploitation of Remote Services · Lateral Movement T1218.001 Compiled HTML File · Defense Evasion T1497 Virtualization/Sandbox Evasion · Defense Evasion T1497.001 System Checks · Defense Evasion T1547 Boot or Logon Autostart Execution · Persistence T1547.001 Registry Run Keys / Startup Folder · Persistence T1558 Steal or Forge Kerberos Tickets · Credential Access T1566 Phishing · Initial Access T1573.001 Symmetric Cryptography · Command And Control T1005 Data from Local System · Collection T1021 Remote Services · Lateral Movement T1048 Exfiltration Over Alternative Protocol · Exfiltration T1071 Application Layer Protocol · Command And Control T1090 Proxy · Command And Control T1189 Drive-by Compromise · Initial Access