Volexity Volcano analyzes UTA0560 and GRIMWEDGE Chrome and Windows zero-day exploit chains

1. Executive summary

Volexity's third "Mind the (Patch) Gap" post is a tooling walkthrough, not a new intrusion report: it demonstrates how Volexity Volcano, Surge Collect Pro and a new Model Context Protocol (MCP) server were used to reconstruct a Chrome and Windows exploit chain that Volexity attributes to UTA0560 and GRIMWEDGE. The underlying activity is the September 2026 campaign in which a spear-phishing email redirected victims through a reflected XSS on a legitimate site to a multi-stage exploit chain: CVE-2026-85046 (Chrome V8 type confusion), CVE-2026-87491 (WebAssembly sandbox escape) and CVE-2026-85880 (Windows kernel privilege escalation). No CVSS score, severity rating or CISA KEV entry is recorded for any of these three CVEs, so this advisory does not assign one. The relevance to EMEA financial services is defensive rather than novel: the post confirms that the post-exploitation components were memory-only (reflectively loaded DLLs and position-independent shellcode inside chrome.exe) and that a GRIMWEDGE-encoded JavaScript artefact was recovered from free memory, which standard EDR and antivirus do not inspect. Attribution to UTA0560 and GRIMWEDGE is unconfirmed: neither actor has a MITRE ATT&CK profile, and the campaign detail rests on Volexity reporting alone.

2. Regulatory framing

3. Technical analysis & attack chain

The confirmed chain below is drawn from Volexity's Part 1 and Part 2 reporting; Part 3 adds the forensic reconstruction, not new exploitation steps.

1. A spear-phishing email is sent from a UTA0560-controlled account. The body contains a link to a legitimate website that is vulnerable to reflected cross-site scripting.
2. The XSS redirects the victim to threat-actor infrastructure, in the observed case hxxps://cloud.shinewrist[.]net/<removed>/Files1.html.
3. The landing page runs the exploit chain. CVE-2026-85046, a type-confusion bug in the Chrome V8 JavaScript engine, gives arbitrary read/write inside the V8 sandbox.
4. CVE-2026-87491, a separate WebAssembly defect, escapes the V8 sandbox.
5. CVE-2026-85880, a Windows kernel vulnerability, escapes the Chrome renderer sandbox and injects code into the Chrome browser process.
6. The chain downloads and executes a payload of the operator's choice. UTA0560 and JungleBamboo used byte-for-byte identical shellcode; the post-exploitation malware differed per actor.
7. A decoy image mimicking an organisation-specific donation form is displayed in the browser while the exploit runs, so the user sees nothing unusual.

The patch gap is the notable part of the timeline. CVE-2026-85046 was reported to the Chromium project on 4 August 2026 and a fix entered the open-source Chromium codebase, but no fixed Google Chrome release existed when the phishing ran on 1 September 2026. The bug was an N-day at Chromium source level and a zero-day against shipped Chrome. Volexity also observed a third actor, UTA0565, using the same chain on 3-4 September 2026, before patches shipped, from spoofed domains including chinadigitaltimes[.]top and americanprgoress[.]top. The spoofed site loaded a hidden iframe pointing at /config.html, which carried the same exploit components with a replaced payload; that campaign delivered chrome_cleanup.exe, a CLEANGULP sample with a hardcoded C2 domain thecovnresation[.]com.

Part 3's forensic findings are the operational value for defenders. Volcano's built-in indicators flagged the memory-only components, specifically reflectively loaded DLLs and position-independent shellcode inside chrome.exe, plus the persistence mechanism, privilege anomalies and invalid parent/child process relationships. The malicious hostname cloud.shinewrist[.]net appeared in event logs and in the command lines of command shells and curl processes. After new indicators were created and re-run, a GRIMWEDGE-encoded JavaScript artefact was recovered from free memory (slack space), which Volexity notes is inaccessible to standard EDR and antivirus and difficult for an actor to erase without destabilising the system.

Confidence caveats. The actor attributions to UTA0560, GRIMWEDGE, JungleBamboo and UTA0565 are Volexity's and are single-sourced; none of these actors has a MITRE ATT&CK profile, so the attribution is unconfirmed. The CLEANGULP capability list (shell, ps, upload, download, bof) comes from partial dynamic analysis, which Volexity states explicitly. The MCP workflow described in Part 3 was run against a deliberately compromised lab VM, not a production estate, so the timings and automation behaviour shown are lab results.

4. Mitigation & containment

P1 (within 24 hours)

• Confirm Chrome version across the estate and force an update to a build that contains the Chromium fix for CVE-2026-85046, CVE-2026-87491 and the Windows kernel fix for CVE-2026-85880. Where a fixed build is not yet deployable, treat any host that browsed to the campaign infrastructure as compromised.
• Hunt for the hostname cloud.shinewrist[.]net in web proxy logs, DNS logs, browser history and process command lines. Volexity observed it in event logs and in curl and command-shell command lines, so command-line telemetry is a valid pivot.
• Hunt for chrome.exe spawning child processes, and for unsigned or reflectively loaded modules inside chrome.exe. These are the memory-only components that triggered Volcano's built-in indicators.
• Block cloud.shinewrist[.]net, chinadigitaltimes[.]top, americanprgoress[.]top and thecovnresation[.]com at the proxy and DNS resolver. These are single-sourced from Volexity; verify against your own telemetry before permanent enforcement.

P2 (within 72 hours)

• Acquire memory from any host confirmed to have loaded the exploit chain. The GRIMWEDGE-encoded JavaScript was recovered only from free memory, so file-based collection alone will miss it. Capture RAM, system and user registry hives, event logs, the USN journal ($UsnJournal) and the master file table ($MFT), which is the artefact set Volexity used.
• Review email gateway logs for the UTA0560 lure pattern: a link to a legitimate third-party site that redirects to actor infrastructure, with a donation-form decoy. Volexity saw matching unsuccessful lures in March 2026, so search back at least six months.
• If CLEANGULP is suspected, look for the command set shell, ps, upload, download and bof in beacon traffic, and for the hardcoded C2 thecovnresation[.]com.

P3 (within 7 days)

• Add the three CVE identifiers to the vulnerability management exception review so that any host still on an unfixed Chrome build is tracked with an owner and a date.
• If memory forensics tooling is used for incident work, confirm the data-handling terms for the AI model and CTI feed in the investigation path before the next live case, per the DORA Art. 28 row above.
• Re-run host indicators after any new Volexity threat-intel release. The Part 3 workflow re-ran indicators against the same evidence and surfaced additional artefacts that the first pass did not.

5. Indicators of compromise

domain  cloud[.]shinewrist[.]net
url  hxxps://cloud[.]shinewrist[.]net/<removed>/Files1.html
domain  chinadigitaltimes[.]top
domain  americanprgoress[.]top
url  hxxps://americanprgoress[.]top/chrome_cleanup.exe
domain  thecovnresation[.]com
ipv4  96[.]9[.]125[.]52
md5  177652713dad3c128bd9195abf2b7603
sha1  668aa5551315ab26b67118fbb29f8e4560a1e1af
sha256  8858ea412dc306b3558885af18006c5ca24689e8875733b5e13b3c2692e603cb
filename  chrome_cleanup.exe

Behavioural indicators

6. Detection

rule CLEANGULP_ChromeCleanup_Strings
{
    meta:
        author = "Adverse Trace"
        date = "2026-10-16"
        reference = "https://www.volexity.com/blog/2026/09/21/mind-the-patch-gap-part-2-fake-websites-used-to-deploy-chrome-windows-0-day-exploits/"
        description = "Detects CLEANGULP payload chrome_cleanup.exe by hardcoded C2 domain and command strings"
    strings:
        $c2 = "thecovnresation.com" ascii wide
        $cmd1 = "shell" ascii wide
        $cmd2 = "upload" ascii wide
        $cmd3 = "download" ascii wide
        $cmd4 = "bof" ascii wide
    condition:
        uint16(0) == 0x5A4D and $c2 and 2 of ($cmd*)
}

title: Chrome Exploit Chain Network and Process Activity
id: 8f3a1c2e-4b7d-4e9a-9c1f-2d6e8a0b5f31
status: experimental
description: Detects network connections to known exploit-chain infrastructure and curl or command-shell processes referencing the campaign hostname
author: Adverse Trace
date: 2026/10/16
references:

    - https://www.volexity.com/blog/2026/10/16/mind-the-patch-gap-part-3-analysis-with-volexity-volcano-threat-intel-and-mcp/
logsource:
    category: process_creation
    product: windows
detection:
    selection_hostname:
        CommandLine|contains:

            - 'cloud.shinewrist.net'
            - 'americanprgoress.top'
            - 'thecovnresation.com'
    selection_tools:
        Image|endswith:

            - '\curl.exe'
            - '\cmd.exe'
            - '\powershell.exe'
    condition: selection_hostname and selection_tools
falsepositives:

    - Security testing or threat-intel research referencing the same hostnames
level: high

7. Sources

• Volexity, "Mind the (Patch) Gap, Part 3: Analysis with Volexity Volcano, Threat Intel, and MCP", https://www.volexity.com/blog/2026/10/16/mind-the-patch-gap-part-3-analysis-with-volexity-volcano-threat-intel-and-mcp/, 16 October 2026.
• Volexity, "Mind the (Patch) Gap: Multiple Chinese Threat Actors Chain 0-day Exploits in Chrome & Windows", https://www.volexity.com/blog/2026/09/09/mind-the-patch-gap-multiple-chinese-threat-actors-chain-0-day-exploits-in-chrome-windows/, 9 September 2026.
• Volexity, "Mind the (Patch) Gap, Part 2: Fake Websites Used to Deploy Chrome & Windows 0-Day Exploits", https://www.volexity.com/blog/2026/09/21/mind-the-patch-gap-part-2-fake-websites-used-to-deploy-chrome-windows-0-day-exploits/, 21 September 2026.
• Volexity threat-intel repository, Chrome indicators, https://github.com/volexity/threat-intel/tree/main/2026/2026-09-09%20Chrome.

8. Adverse Trace position

No CVSS score, severity rating or CISA KEV entry is recorded for CVE-2026-85046, CVE-2026-87491 or CVE-2026-85880, so we do not assign one; the practical severity for a client depends on whether Chrome builds containing the Chromium fix are deployed and whether memory-only artefacts are being collected. The client impact is concentrated in detection coverage rather than in a new capability: the campaign's post-exploitation components lived in chrome.exe memory and in free memory, so an estate relying on file-based EDR and antivirus alone would not have seen them. Attribution to UTA0560 and GRIMWEDGE is unconfirmed, resting on Volexity reporting with no MITRE ATT&CK profile for either actor, and every indicator in §5 is single-sourced from Volexity and should be verified against client telemetry before permanent blocking. We will track the Chromium fix reaching shipped Chrome builds and will re-issue if Volexity publishes additional indicators or if any of the three CVEs is added to CISA KEV.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.