Executive Summary
In September 2026, Volexity identified a third Chinese threat actor, UTA0565, exploiting a chain of zero-day vulnerabilities in Google Chrome (CVE-2026-85046, CVE-2026-87491) and Microsoft Windows (CVE-2026-85880). The actor targeted Asian government entities and NGOs by using sophisticated phishing campaigns that directed victims to spoofed domains impersonating media organizations like China Digital Times and The Center for American Progress.
The attack chain involves the delivery of a previously undocumented malware family dubbed CLEANGULP. This malware is heavily obfuscated using control flow flattening and indirect calls, designed to hinder analysis while providing full backdoor capabilities, including process listing and Beacon Object File (BOF) execution. The widespread use of the same underlying exploit kit across multiple Chinese APT groups suggests a high degree of resource sharing and coordination within the Chinese CNE community.
This campaign represents a significant threat due to the actor's ability to weaponize unpatched vulnerabilities rapidly and their use of highly convincing decoy content. Organizations in the government and non-profit sectors should prioritize patching these specific vulnerabilities and monitoring for the indicators of compromise associated with the UTA0565 infrastructure.