Chinese Hackers Exploit Three Consecutive Chrome Zero-Day Vulnerabilities to Deploy GRIMWEDGE Malware
29 Oct 2026
A China-linked hacker group tracked as UTA0560 has been identified as being behind the BlueMoon cyberattack campaign, which exploited zero-day vulnerabilities in Google Chrome and Windows to distribute a backdoor called GRIMWEDGE, primarily targeting NGOs, according to The Hacker News, citing research from the Volexity security team.
Three Vulnerabilities Chained to Evade the Sandbox and Escalate Privileges
The attack begins with a spear-phishing email that tricks victims into clicking a link to a U.S. university website before exploiting a reflected cross-site scripting (XSS) vulnerability to redirect them to a malicious website specifically designed to target Google Chrome users.
The campaign chains together three vulnerabilities:
CVE-2026-85046: Allows arbitrary reading or writing of data within the V8 Sandbox
CVE-2026-87491: Enables escape from the Chrome Sandbox
CVE-2026-85880: A Windows ALPC vulnerability used to escalate privileges to SYSTEM
After successfully compromising the system, the attackers use three sets of shellcode to survey the victim's machine, escalate privileges, and inject code into a browser process. They then download the msgbox.exe file and a malicious DLL named wsc.dll, using DLL sideloading to conceal the malware's activity.
GRIMWEDGE Controls Victims' Machines Through a C2 Server
Once GRIMWEDGE is successfully installed, the malware connects to a command-and-control (C2) server at the domain ocr.opusaccel[.]top to await instructions from the attackers. It can survey the system, list files, create or delete folders, inspect and terminate processes, read files, remotely execute commands, and transfer data in chunks.
These capabilities allow the attackers to maintain control of compromised machines and continuously access data within the systems.
Organizations Urged to Update Systems and Monitor for Threats
The BlueMoon case highlights the risks posed by chaining multiple vulnerabilities, from compromising a browser to escalating privileges on the operating system. Organizations should update Google Chrome and Windows to patched versions, inspect suspicious emails and links, and monitor for abnormal DLL loading and connections to unknown C2 servers.
Source: thehackernews.com
Other related
IT News, Safari, Apple, Adaptive Dark ModeSafari Tests Adaptive Dark Mode, a Feature That Automatically Converts Websites to Dark Mode
IT News, Microsoft Edge, PDFMicrosoft Edge Adds PDF Management Features to Split, Delete, Rotate, and Merge Files in the Browser
IT News, ChatGPT, Claude, OpenAI
